`key` is not valid for passed `access_token`, token not found (although seemingly valid authentication)

Question

I've made an authentication flow for my app (which wants to read your inbox and sent notifications on your desktop). Which can be found here

For this, I have created a stack app on this site. With the following key:ZT8kn8gmTEK79y56UyFLiw(( and client_id:18315 .

Thus the authentication url would be like this: https://stackoverflow.com/oauth?client_id=18315&scope=read_inbox,no_expiry&redirect_uri=https://chielchiel.nl/stacknotifier/

It creates an request url like:

https://api.stackexchange.com/2.2/inbox?access_token=[token]&key=ZT8kn8gmTEK79y56UyFLiw((

The site creates (now for debug purposes only) the request url. However the request gives the following error

{"error_id":403,"error_message":"key is not valid for passed access_token, token not found.","error_name":"access_denied"}

What am I missing? I'm stuck on this problem for some days already...

Answer 1

You are using explicit OAuth 2.0 flow.

When a user approves your app to access the requested scope, they are redirected to the redirect_uri with an authorization code. Your app should use the authorization code to request an access token. In this case, you are using the authorization code as the access token thus the error.

You can view more details on the official documentation.