Refer to [the API Authentication doc page][1], where it says:

> explicit grant (is) for server side applications

Also, see [*What is the difference between the 2 workflows?*][2] and related questions.

Basically, **unless you have your own web server** (and usually your own domain), **use the implicit flow**.   The implicit flow merely requires either a web browser or a program that can act like one -- which your Java program can be made to do.

The explicit flow can nominally be made more secure, but it is not as easy to implement and requires both a client program and a web application to be developed (and hosted) by you.

1. Use the "implicit OAuth 2.0 flow" (Client side).  Activate `Enable Client Side OAuth Flow` in [your app's control panel][3].
1. Leave `Disable Desktop Application OAuth Redirect Uri` unchecked.
1. Set `OAuth Domain` to `stackexchange.com`.
1. Use `redirect_uri=https://stackexchange.com/oauth/login_success`.
4. Be sure to use `GET` requests for implicit (client side) OAuth and `POST` for explicit (server-side) OAuth.

<br>
When the authentication is successful, the `access_token` will be in the `location.hash` of the redirected page.  For example:

    https://stackexchange.com/oauth/login_success#access_token=5bcPtLjiyuySD7WeKSo3Mw))&expires=86399


  [1]: http://api.stackexchange.com/docs/authentication
  [2]: https://stackoverflow.com/questions/16321455/what-is-the-difference-between-the-2-workflows-when-to-use-authorization-code-f
  [3]: https://stackapps.com/apps/oauth/