No 'Access-Control-Allow-Origin' for oauth/access_token

Question

Following the Stack Apps documentation Authentication (explicit) section I crafted this AJAX call

        $.ajax({
            url:"https://stackexchange.com/oauth/access_token",
            type:"POST",
            data: {
                client_id: myClientID,
                client_secret: myClientSecret,
                code: getUrlParameter("code"),
                redirect_uri: "https://myapp.com/sameAsBefore" 
            },
            success: function(data){
                console.log(data);
            }
        });

However, this is not accepted.

XMLHttpRequest cannot load https://stackexchange.com/oauth/access_token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://myapp.com' is therefore not allowed access.

I tried removing the contentType and dataType as they will default to application/x-www-form-urlencoded and a best guess for the returning data. No change if they are there or not.

Any ideas what I am missing?

Answer 1

The question is not clear enough.
You appear to be trying to use jQuery to do explicit OAuth from a web page. If so, this is not allowed.

Explicit OAuth is for servers. You are not running that code in node.js are you?

Anything that runs in the user's browser, like javascript, needs to use "implicit" (Client side) OAuth. Implicit OAuth was developed for that purpose.

This answer gives the setup and steps needed to use the implicit (Client side) OAuth flow.

This answer gives working code to implement implicit OAuth in a userscript, if you are trying to do that. (Not the same as a web page's javascript.)

---

---

If you have your own server, and control the webpage(s), then you would use explicit OAuth. But you need to do it properly (no client-side AJAX for the OAuth bits). That includes: when your server POSTS to stackexchange.com/oauth/access_token it must do it as though it is browsing that page.