12

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet. Crucial Points: Do not specify a redirect_uri to any server that you do not control. When you use something like redirect_uri=https://www.yahoo.com/, then a third ...


10

The implicit flow uses the url https://stackexchange.com/oauth/dialog, not https://stackexchange.com/oauth. You should just need to change the url, otherwise that looks correct.


9

Some comments on the new features: Authentication I really dislike an authentication flow which mandates a call out to a browser. It makes command line applications basically impossible. It makes consistent UIs for specific platforms very hard (e.g. iPhone), as you basically have to dump the user into a web browser with an entirely different UI. It also ...


8

I would like to see fixed paging. And yes, that means I think the current system is broken. What do I mean by broken? When you want to get 500 newest questions and the page size is 100, it's impossible to do so without the possibility of duplicates (which are easy to ignore) or (much worse) missing questions. This happens because you can access page 1, ...


7

The fix for me was unchecking "Enable Client Side OAuth Flow"


7

Oy, that was an annoying one. Subtle, as the bug only happened when you're not logged in but would be automatically logged in when you visit stackexchange.com. The actual root cause was just over-encoding a url.


7

I would be interested in seeing a /me/votes route to get a list of all my upvotes and downvotes. Note that this would only apply to my voting history and not anyone else's.


5

I had a similar issue a few months ago ago, and I came up with a couple of suggestions, one exactly like how you suggested: Ask the user for the email associated with their account, MD5 it, and compare it to the value provided by the API. This works, provided it isn't essential that the user is who he says he is - a users email may be publicly available, ...


5

Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms: "Explicit" "Implicit" "Server side" "Client side" a little interchangeably. (The first 2 are roughly synonymous with the last two.) From the javascript SDK docs: Your application must have the client side OAuth flow enabled, and must not have the ...


4

Your second call must be https:. You actually got an error like: "error_id":406, "error_message":"Access token sent over non-HTTPS request, it has been invalidated", "error_name":"access_token_compromised" On the first attempt. Only subsequent attempts, with the same token, would yield the 'key' is not valid for passed 'access_token' error. When I ...


3

I faced the same issue when I was using the stack exchange API to post a message to stack overflow website. I figured I had to post my application on a domain name. I hosted my application on free domain provided by 000webhost.com. You may wish to take a similar approach. After deploying the application on the domain, change the oauth domain and the ...


3

Reference: Stack Exchange API Authentication Looking for a beginner's tutorial to using the API Yeah the registration form now says, "Website URL is required". So, if you don't have your own website: Enter stackexchange.com as the Application Website. Enter stackexchange.com as the OAuth Domain. This will allow you to use https://stackexchange.com/...


3

Use implicit OAuth flow. Load the specified URL with necessary query parameters into a webview and when authentication is done you can get the access_token from the redirect_uri. You can have the webview handle the redirect_uri by setting a custom webview client. Example: private class ExampleWebViewClient extends WebViewClient { @Override ...


3

DNS went wonky on our end, this has been fixed, those responsible have been beaten. While there's a chance it still won't resolve for some folks, all that should shake itself out within the next 15 minutes or so.


3

This is relatively easy - just make him give you the same email address that he provided for his Stack Exchange account and then calculate the MD5 hash of the email address. Then compare that to the email_hash member of his account data. If the two hashes match, then the user is indeed who they claim to be. If not, they either provided a different email ...


3

I forgot to add the scope in the authentication url according to this document https://api.stackexchange.com/docs/authentication#scope 1.Send a user to https://stackexchange.com/oauth, with these query string parameters ◦client_id ◦scope (details) ◦redirect_uri - must be under an apps registered domain ◦state - optional


3

Refer to the API Authentication doc page, where it says: explicit grant (is) for server side applications Also, see What is the difference between the 2 workflows? and related questions. Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a ...


3

Turns out this is completely my fault :/ I overlooked the expiry aspect of the access token which meant that I got the default 86399 seconds (~24 hours), which meant my users had to get a new access token every day. Because this is a userscript which is used daily, it makes sense to have a no_expiry scope so that the user doesn't have to repeatedly ...


3

You only need to use OAuth if you are trying to add or modify data (including votes). If you want to do that, your app must log in as a user, no exceptions. If you just want to read or search data, don't bother with OAuth (or an access_token). Reference: Is it okay to just send the API key (without implementing oauth-2 login)? How to increase app request ...


3

There have been no reported changes to the API, officially for many years, (unofficially since January). But, frankly that script's approach should have never worked. OAuth credentials are sent to:     https://stackapps.com/a/7936#access_token=y6rVASxxxxxxxxxRO2R9Bg)) (for example) But this is immediately 302 redirected to:     https://...


2

The token does not appear because of the way urllib2 handles the redirect. I am not familiar with the details so I won't elaborate here. The solution is to catch the 302 before urllib2 handles the redirect. This can be done by sub-classing the urllib2.HTTPRedirectHandler to get the redirect with its hash and token. Here is a short example of subclassing the ...


2

I've updated the documentation with a section about errors. This behavior is defined more by the OAuth 2.0 spec than by me, so it's naturally a little out of sync with the rest of the API. Authentication is also just... weird when compared to pure data queries. The answer is, it depends. In no case during implicit authentication is a 400 possible, sine ...


2

This isn't possible, for simplicity reasons. Right now there are a few states a user can get into w.r.t. authentication: logged in, app not authorized need to authorize app app not in app tab logged in, app authorized no prompt app in app tab not logged in, app not authorized need to login, then authorize app app not in app tab not logged in, app ...


2

key is your app key, access_token identifies a user (and a set of permissions) and is what you get at the end of an authentication flow. Keys are not secret, for example here's what the Documentation Console's registration looks like: You can find your app key by going to Manage Your Applications (in the Stack Apps homepage sidebar) and selecting one of ...


2

The /me/associated routeDoc is the preferred way to turn an access_token into a list of users, it returns the collection of per-site user details that can be quickly fetched. It's basically the user's account tab. If you need more details about a user on a give site, then turn around and hit /me (or /users/{ids}) on the sites you've discovered via /me/...


2

I found answer myself and posted in my blog post StackAlert Firefox Extension error key is not valid for passed access_token Solution in brief When you remove the application from StackExchange apps, and even after uninstalling the extension from Firefox, you will still have traces of that extension in Firefox. To make this extension work again, we have ...


2

In my particular case, I somehow managed to append % character to the end of the access_token. There should be no % character at the end of the access_token.


2

Your apps registered domain must match that the url passed as channelUrl. You'll need to update your app's domain from actionbox.io to cybertron-nodejs-11139.apse1.actionbox.io (or whatever other full, stable domain your app ends up at).


2

So, this was a fun one. :) We apparently broke several different things over the course of a year that went unnoticed until Google turned off OpenID support. In no particular order but for fun and posterity: Facebook OAuth authentication just straight up didn't work. It broke back in January of 2014 when the code was accidentally changed from function ...


2

Yes, I always get 86399 too. And, no, you can't specify an interval other than no_expiry. But you can call /access-tokens/{accessTokens}/invalidateDoc at whatever interval you wish. So, for less user annoyance, set no_expiry but then call /invalidate every, say, 8 days, for example.


Only top voted, non community-wiki answers of a minimum length are eligible