Return to Revisions

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet.

Crucial Points:

1. Do not specify a redirect_uri to any server that you do not control!!!
   When you use something like redirect_uri=https://www.yahoo.com/, then a third party host has you, or your user's, credentials! That page/server will see a request like:

   https://www.yahoo.com/#access_token=X0duhxxxxxxxxxxxNvfDbQ%29%29&expires=86399
   

It can then use that access_token to do unspeakable evil.

This is a major breach of both security and trust! _{(Frankly, if you or your app are caught doing this, lifetime bans should be issued. Legal action may even be appropriate in some cases.)}

2. The value you set for OAuth Domain must match the redirect_uri.

So, if you use, redirect_uri=http://10.0.0.86/myscript.php,
then you must set OAuth Domain to 10.0.0.86.

3. If you do not have your own server:

   1. Use the "implicit OAuth 2.0 flow" (Client side). Activate Enable Client Side OAuth Flow in your app's control panel.
   2. Leave Disable Desktop Application OAuth Redirect Uri unchecked.
   3. Set OAuth Domain to stackexchange.com.
   4. Use redirect_uri=https://stackexchange.com/oauth/login_success.
      
      

4. Be sure to use GET requests for implicit (client side) OAuth and POST for explicit (server-side) OAuth.

When the authentication is successful, the `access_token` will be in the `location.hash` of the redirected page. For example:

https://stackexchange.com/oauth/login_success#access_token=5bcPtLjiyuySD7WeKSo3Mw))&expires=86399