Return to Revisions

Refer to the API Authentication doc page, where it says:

explicit grant (is) for server side applications

Also, see What is the difference between the 2 workflows? and related questions.

Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a program that can act like one -- which your Java program can be made to do.

The explicit flow can nominally be made more secure, but it is not as easy to implement and requires both a client program and a web application to be developed (and hosted) by you.

1. Use the "implicit OAuth 2.0 flow" (Client side). Activate Enable Client Side OAuth Flow in your app's control panel.
2. Leave Disable Desktop Application OAuth Redirect Uri unchecked.
3. Set OAuth Domain to stackexchange.com.
4. Use redirect_uri=https://stackexchange.com/oauth/login_success.
5. Be sure to use GET requests for implicit (client side) OAuth and POST for explicit (server-side) OAuth.

When the authentication is successful, the `access_token` will be in the `location.hash` of the redirected page. For example:

https://stackexchange.com/oauth/login_success#access_token=5bcPtLjiyuySD7WeKSo3Mw))&expires=86399