I had a developer setup StackExchange auth for a site last year and that still works fine. I have cloned that site and am in the process of changing out all of the relevant names and keys to the new site, hoping that it would Just Work. But alas, I am getting this error:

enter image description here

I haven't changed very much from the flow that i said was working for the other site, just trying to swap out the keys and such. Here is the JS code:

                clientId: <?php echo STACKAPPS_CLIENT_ID; ?>,
                key: '<?php echo STACKAPPS_KEY; ?>',
                channelUrl: '<?php echo STACKAPPS_CHANNEL; ?>',
                complete: function (data) {
            // Attach click handler to login button
            $('#soLo').click(function() {
                // Make the authentication call, note that being in an onclick handler
                //   is important; most browsers will hide windows opened without a
                //   'click blessing'
                    success: function(data) { 
                        $.get('sign-in.php?seat='+data.accessToken,function() {

                    error: function(data) { 
                        //alert('An error occurred:\n' + data.errorName + '\n' + data.errorMessage); 
                    networkUsers: false

And the PHP that button press redirects to:

if ($_REQUEST['seat']) {
//check if seUser is real;
    $ch = curl_init(); 
    curl_setopt($ch, CURLOPT_URL, "https://api.stackexchange.com/2.1/me?key=".STACKAPPS_KEY."&site=stackoverflow&order=desc&sort=reputation&access_token=".$_REQUEST['seat']."&filter=default"); 
    curl_setopt($ch,CURLOPT_ENCODING , "gzip");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
    $output = json_decode(curl_exec($ch)); 
    if ($output->items[0]->account_id) {
        $_SESSION['seUser'] = $output->items[0]->account_id;
        $_SESSION['displayName'] = $output->items[0]->display_name;
        $_SESSION['seReputation'] = $output->items[0]->reputation;
        $params = array(
            'className' => 'users',
            'query' => array(
                'so_id'=> (string) $_SESSION['seUser']
            'limit' => '1',
        $request = json_decode($parse->query($params));
        $user = $request->results[0]->username;
        $_SESSION['login'] = 'stack';
        if ($user) {
            $_SESSION['curUser'] = $user;
            $_SESSION['logout'] = true;
        } else {
            $_SESSION['saveSo'] = true;

Does anything look out of place here? I looked at the auth documentation and it looks like I am following the implicit path.


1 Answer 1


Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms:

  • "Explicit"
  • "Implicit"
  • "Server side"
  • "Client side"

a little interchangeably. (The first 2 are roughly synonymous with the last two.)

From the javascript SDK docs:

Your application must have the client side OAuth flow enabled, and must not have the desktop application redirect uri disabled. Both of these settings are available on an applications edit page.

  1. Go to your apps list (visible only to you).
  2. Click on your app.
  3. Check your settings. See the picture, below:

    1. Enable Client Side OAuth Flow ==> checked

    2. Disable Desktop Application OAuth Redirect Uri ==> not checked

    3. OAuth Domain ==> stackexchange.com

    4. Application Name ==> (not blank and no error message)

    5. Description ==> (not blank and no error message)

    6. Application Website ==> https://stackapps.com/ (Not critical for this kind of auth.)

    7. Optional: If you want write access, Stack Apps Post must be set to a valid post that you own.
      EG, https://stackapps.com/questions/5017/ works for the user that owns that post.

      The post must legitimately have either the or the tag.

Key settings


All settings


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .