7

I had a developer setup StackExchange auth for a site last year and that still works fine. I have cloned that site and am in the process of changing out all of the relevant names and keys to the new site, hoping that it would Just Work. But alas, I am getting this error:

enter image description here

I haven't changed very much from the flow that i said was working for the other site, just trying to swap out the keys and such. Here is the JS code:

SE.init({
                clientId: <?php echo STACKAPPS_CLIENT_ID; ?>,
                key: '<?php echo STACKAPPS_KEY; ?>',
                channelUrl: '<?php echo STACKAPPS_CHANNEL; ?>',
                complete: function (data) {
                    //console.log(data);
                }
            });
            // Attach click handler to login button
            $('#soLo').click(function() {
                // Make the authentication call, note that being in an onclick handler
                //   is important; most browsers will hide windows opened without a
                //   'click blessing'
                SE.authenticate({
                    success: function(data) { 
                        $.get('sign-in.php?seat='+data.accessToken,function() {
                            location.reload();
                        });
                        //$('#soLo').hide();

                    },
                    error: function(data) { 
                        //alert('An error occurred:\n' + data.errorName + '\n' + data.errorMessage); 
                    },
                    networkUsers: false
                });
            });

And the PHP that button press redirects to:

if ($_REQUEST['seat']) {
//check if seUser is real;
    $ch = curl_init(); 
    curl_setopt($ch, CURLOPT_URL, "https://api.stackexchange.com/2.1/me?key=".STACKAPPS_KEY."&site=stackoverflow&order=desc&sort=reputation&access_token=".$_REQUEST['seat']."&filter=default"); 
    curl_setopt($ch,CURLOPT_ENCODING , "gzip");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
    $output = json_decode(curl_exec($ch)); 
    curl_close($ch);  
    if ($output->items[0]->account_id) {
        $_SESSION['seUser'] = $output->items[0]->account_id;
        $_SESSION['displayName'] = $output->items[0]->display_name;
        $_SESSION['seReputation'] = $output->items[0]->reputation;
        $params = array(
            'className' => 'users',
            'query' => array(
                'so_id'=> (string) $_SESSION['seUser']
            ),
            'limit' => '1',
        );
        $request = json_decode($parse->query($params));
        $user = $request->results[0]->username;
        $_SESSION['login'] = 'stack';
        if ($user) {
            $_SESSION['curUser'] = $user;
            $_SESSION['logout'] = true;
        } else {
            $_SESSION['saveSo'] = true;
        }
    }
    session_write_close();
    die();
}

Does anything look out of place here? I looked at the auth documentation and it looks like I am following the implicit path.

  • 1
    Is the app listed as being client-side auth flow on your apps list? – Tim Stone Nov 17 '15 at 20:49
  • It says server side! That must be it. Not sure how to change that though. – Lizza Nov 17 '15 at 20:50
  • Oh, there is that checkbox, trying... – Lizza Nov 17 '15 at 20:50
  • 1
    What do you know, that did the trick. THANK YOU – Lizza Nov 17 '15 at 20:51
  • Related or duplicate: stackapps.com/questions/6242/… – Brock Adams Nov 17 '15 at 22:24
5

Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms:

  • "Explicit"
  • "Implicit"
  • "Server side"
  • "Client side"

a little interchangeably. (The first 2 are roughly synonymous with the last two.)

From the javascript SDK docs:

Your application must have the client side OAuth flow enabled, and must not have the desktop application redirect uri disabled. Both of these settings are available on an applications edit page.


  1. Go to your apps list (visible only to you).
  2. Click on your app.
  3. Check your settings. See the picture, below:

    1. Enable Client Side OAuth Flow ==> checked

    2. Disable Desktop Application OAuth Redirect Uri ==> not checked

    3. OAuth Domain ==> stackexchange.com

    4. Application Name ==> (not blank and no error message)

    5. Description ==> (not blank and no error message)

    6. Application Website ==> https://stackapps.com/ (Not critical for this kind of auth.)

    7. Optional: If you want write access, Stack Apps Post must be set to a valid post that you own.
      EG, https://stackapps.com/questions/5017/ works for the user that owns that post.

      The post must legitimately have either the or the tag.


Key settings

Then:

All settings

  • 1
    I have all these set but am still getting the error. I am calling stackexchange.com/oauth/… manually, not from JS code. I just want to obtain the tokens during testing – codecowboy Aug 9 '16 at 6:39
  • @codecowboy, What do you see (in the address bar) when you visit and authorize this URL: stackexchange.com/oauth/… ? Also, you should really open a new question if you are sure you have a new problem. – Brock Adams Aug 9 '16 at 7:05
  • @BrookAdams. Thanks. turns out I had a typo in my request :-/ – codecowboy Aug 10 '16 at 7:15
  • Thumbs up. This was helpful! Moving on, this is my error now: The target origin provided ('localhost') does not match the recipient window's origin ('localhost:8080') – noogui Jan 29 '18 at 7:55
  • @noogui, Although API authentication does not seem to work with nonstandard port numbers. See question numbers 4733 and 4596. This may be by design as a (¿poor?) way to ensure SSL. – Brock Adams Jan 29 '18 at 8:07
  • u mean if i changed 8080 to that port it will work? my OAuth Domain is 'localhost' and my Application Website is localhost:4733/folderPath which is the same with 'channelUrl' and 'redirect_uri' – noogui Jan 29 '18 at 8:13
  • im not using XAMPP. Im just using python -m localhost 4596 on my Ubuntu – noogui Jan 29 '18 at 8:18
  • @noogui, You need to set up your local server to use the standard HTTP port (80). – Brock Adams Jan 29 '18 at 8:22
  • 1
    OAuth Success!! Thanks so much @Brock Adams!! – noogui Jan 29 '18 at 8:30
  • @BrockAdams Heya Brock, I've always wondered, why does the /blank.html work? What does this blank html file do? – noogui Feb 2 '18 at 11:51
  • @noogui, that's not relevant to this question. Open a new question if you need to and be more specific. – Brock Adams Feb 2 '18 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .