2

The implicit OAuth flow puts the access token in the hash.
However, I would like to get that in the query (from example.com/hi#access_token=123456 to example.com/hi?access_token=123456) for it to work with my application.

How can I do this? Is there a third-party method for this? Or can I do something to get the access_token in the query instead of the hash?

  • 1
    If you want the server to get the response why wouldn't you use the explicit flow instead? – Tim Stone Apr 25 '17 at 19:28
3

No, you can't get the access_token in the query/search part of the URL. This would be a security leak that would allow 3rd parties to see your access_tokens on the web.
Reference:


If your app is running on a server, use the explicit OAuth flow.

This returns a one-time code to your server -- in the URL query -- which you then POST to /oauth/access_token and receive an SSL encrypted response with the access_token.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .