Skip to main content
1 of 2
Glorfindel
  • 6.9k
  • 3
  • 22
  • 49

Why am I getting an "Access token sent over non-HTTPS request, it has been invalidated" message?

I've been using the Stack Overflow for Teams API for a while now, but since yesterday it stopped working for one of the Teams; that Team also wasn't listed in the Applications (https://stackoverflow.com/users/apps/<user-id>) section anymore.

No big deal, so I decided to regenerate the token, by visiting https://stackoverflow.com/oauth?client_id=<client-id>&scope=read_inbox,no_expiry,write_access,private_info,access_team|stackoverflow.com/c/charcoal&redirect_uri=https://www.example.com (where www.example.com is my OAuth2 Domain associated with the app). I got a code in the redirect, executed curl -d "client_id=<client-id>&client_secret=<client-secret>&code=<code>&redirect_uri=https://www.example.com" -X POST https://stackoverflow.com/oauth/access_token and received a new access token. Yet when I use it, in the same way as before, I get an error message as response:

{"error_message":"Access token sent over non-HTTPS request, it has been invalidated","error_name":"access_token_compromised","error_id":406}

How is this possible, since all URLs (including the API call itself) are made over HTTPS?

FWIW, calls made using regular (non-Teams) tokens still work.

Glorfindel
  • 6.9k
  • 3
  • 22
  • 49