3

The implicit OAuth flow puts the access token in the hash.
However, I would like to get that in the query (from example.com/hi#access_token=123456 to example.com/hi?access_token=123456) for it to work with my application.

How can I do this? Is there a third-party method for this? Or can I do something to get the access_token in the query instead of the hash?

Improve this question
1
  • 1
    If you want the server to get the response why wouldn't you use the explicit flow instead? Commented Apr 25, 2017 at 19:28

1 Answer 1

Reset to default
3

No, you can't get the access_token in the query/search part of the URL. This would be a security leak that would allow 3rd parties to see your access_tokens on the web.
Reference:


**If your app is running on a server, use [the explicit OAuth flow][3].**

This returns a one-time code to your server -- in the URL query -- which you then POST to /oauth/access_token and receive an SSL encrypted response with the access_token.

Improve this answer

You must log in to answer this question.