11

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet. Crucial Points: Do not specify a redirect_uri to any server that you do not control. When you use something like redirect_uri=https://www.yahoo.com/, then a third ...


10

The implicit flow uses the url https://stackexchange.com/oauth/dialog, not https://stackexchange.com/oauth. You should just need to change the url, otherwise that looks correct.


7

The fix for me was unchecking "Enable Client Side OAuth Flow"


7

I would be interested in seeing a /me/votes route to get a list of all my upvotes and downvotes. Note that this would only apply to my voting history and not anyone else's.


7

Oy, that was an annoying one. Subtle, as the bug only happened when you're not logged in but would be automatically logged in when you visit stackexchange.com. The actual root cause was just over-encoding a url.


5

Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms: "Explicit" "Implicit" "Server side" "Client side" a little interchangeably. (The first 2 are roughly synonymous with the last two.) From the javascript SDK docs: Your application must have the client side OAuth flow enabled, and must not have the ...


4

Use implicit OAuth flow. Load the specified URL with necessary query parameters into a webview and when authentication is done you can get the access_token from the redirect_uri. You can have the webview handle the redirect_uri by setting a custom webview client. Example: private class ExampleWebViewClient extends WebViewClient { @Override ...


4

Your second call must be https:. You actually got an error like: "error_id":406, "error_message":"Access token sent over non-HTTPS request, it has been invalidated", "error_name":"access_token_compromised" On the first attempt. Only subsequent attempts, with the same token, would yield the 'key' is not valid for passed 'access_token' error. When I ...


3

Reference: Stack Exchange API Authentication Looking for a beginner's tutorial to using the API Yeah the registration form now says, "Website URL is required". So, if you don't have your own website: Enter stackexchange.com as the Application Website. Enter stackexchange.com as the OAuth Domain. This will allow you to use https://stackexchange.com/...


3

I forgot to add the scope in the authentication url according to this document https://api.stackexchange.com/docs/authentication#scope 1.Send a user to https://stackexchange.com/oauth, with these query string parameters ◦client_id ◦scope (details) ◦redirect_uri - must be under an apps registered domain ◦state - optional


3

I faced the same issue when I was using the stack exchange API to post a message to stack overflow website. I figured I had to post my application on a domain name. I hosted my application on free domain provided by 000webhost.com. You may wish to take a similar approach. After deploying the application on the domain, change the oauth domain and the ...


3

DNS went wonky on our end, this has been fixed, those responsible have been beaten. While there's a chance it still won't resolve for some folks, all that should shake itself out within the next 15 minutes or so.


3

Refer to the API Authentication doc page, where it says: explicit grant (is) for server side applications Also, see What is the difference between the 2 workflows? and related questions. Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a ...


3

Turns out this is completely my fault :/ I overlooked the expiry aspect of the access token which meant that I got the default 86399 seconds (~24 hours), which meant my users had to get a new access token every day. Because this is a userscript which is used daily, it makes sense to have a no_expiry scope so that the user doesn't have to repeatedly ...


3

You only need to use OAuth if you are trying to add or modify data (including votes). If you want to do that, your app must log in as a user, no exceptions. If you just want to read or search data, don't bother with OAuth (or an access_token). Reference: Is it okay to just send the API key (without implementing oauth-2 login)? How to increase app request ...


3

There have been no reported changes to the API, officially for many years, (unofficially since January). But, frankly that script's approach should have never worked. OAuth credentials are sent to:     https://stackapps.com/a/7936#access_token=y6rVASxxxxxxxxxRO2R9Bg)) (for example) But this is immediately 302 redirected to:     https://...


3

I've just done a couple of tests with my placeholder app. Even though the question is closed, I was able to generate a new access token (following the regular procedure) for my sockpuppet account, and with it I was able to edit an answer in the Sandbox. The token for my regular account continues to work as well. When the post is deleted, write access is ...


2

The token does not appear because of the way urllib2 handles the redirect. I am not familiar with the details so I won't elaborate here. The solution is to catch the 302 before urllib2 handles the redirect. This can be done by sub-classing the urllib2.HTTPRedirectHandler to get the redirect with its hash and token. Here is a short example of subclassing the ...


2

I've updated the documentation with a section about errors. This behavior is defined more by the OAuth 2.0 spec than by me, so it's naturally a little out of sync with the rest of the API. Authentication is also just... weird when compared to pure data queries. The answer is, it depends. In no case during implicit authentication is a 400 possible, sine ...


2

This isn't possible, for simplicity reasons. Right now there are a few states a user can get into w.r.t. authentication: logged in, app not authorized need to authorize app app not in app tab logged in, app authorized no prompt app in app tab not logged in, app not authorized need to login, then authorize app app not in app tab not logged in, app ...


2

key is your app key, access_token identifies a user (and a set of permissions) and is what you get at the end of an authentication flow. Keys are not secret, for example here's what the Documentation Console's registration looks like: You can find your app key by going to Manage Your Applications (in the Stack Apps homepage sidebar) and selecting one of ...


2

In my particular case, I somehow managed to append % character to the end of the access_token. There should be no % character at the end of the access_token.


2

Your apps registered domain must match that the url passed as channelUrl. You'll need to update your app's domain from actionbox.io to cybertron-nodejs-11139.apse1.actionbox.io (or whatever other full, stable domain your app ends up at).


2

So, this was a fun one. :) We apparently broke several different things over the course of a year that went unnoticed until Google turned off OpenID support. In no particular order but for fun and posterity: Facebook OAuth authentication just straight up didn't work. It broke back in January of 2014 when the code was accidentally changed from function ...


2

The /me/associated routeDoc is the preferred way to turn an access_token into a list of users, it returns the collection of per-site user details that can be quickly fetched. It's basically the user's account tab. If you need more details about a user on a give site, then turn around and hit /me (or /users/{ids}) on the sites you've discovered via /me/...


2

I found answer myself and posted in my blog post StackAlert Firefox Extension error key is not valid for passed access_token Solution in brief When you remove the application from StackExchange apps, and even after uninstalling the extension from Firefox, you will still have traces of that extension in Firefox. To make this extension work again, we have ...


2

Yes, I always get 86399 too. And, no, you can't specify an interval other than no_expiry. But you can call /access-tokens/{accessTokens}/invalidateDoc at whatever interval you wish. So, for less user annoyance, set no_expiry but then call /invalidate every, say, 8 days, for example.


2

Yes, each time you invoke stackexchange.com/oauth/ you will get a fresh access token, even though old ones may still be valid. For example: Go to /me/inboxLivedoc and hit Get Token twice, recording the token value each time (It will always be different). Then go to /access-tokens/{accessTokens}Livedoc and check each token. They will both still be valid! (...


2

That error means either that you've misconfigured the app or that the authentication call is incorrect. Note that stackexchange.com/oauth/login_success is not a valid redirect_uri irregardless. You probably want/need to use Client side (Implicit) authentication, in which case the redirect_uri would be:           https://...


2

Dealing with token expiration is pretty simple. When a token is/goes bad then, when you make an API call that uses the token, you will get a JSON response like this: { "error_id": 403, "error_message": "`key` is not valid for passed `access_token`, token not found.", "error_name": "access_denied" } At that point, just re-authenticate. You can ...


Only top voted, non community-wiki answers of a minimum length are eligible