Hot answers tagged

11

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet. Crucial Points: Do not specify a redirect_uri to any server that you do not control. When you use something like redirect_uri=https://www.yahoo.com/, then a third ...


10

The implicit flow uses the url https://stackexchange.com/oauth/dialog, not https://stackexchange.com/oauth. You should just need to change the url, otherwise that looks correct.


7

The fix for me was unchecking "Enable Client Side OAuth Flow"


6

Your value for channelUrl is nominally correct. If I set up my XAMPP server, via httpd.conf to use port 8000, then this HTML page works perfectly fine for me: <!DOCTYPE html> <html><head> <title>StackApps SDK auth test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head><...


5

Go to your profile: https://stackapps.com/users/current Click the "Edit Profile & Settings" tab: https://stackapps.com/users/edit/current Click "Applications" on the left sidebar (no handy universal link for this, but it'll take you to a URL like https://stackapps.com/users/apps/53175 where 53175 is your user ID) And there you'll have your list of ...


4

Your second call must be https:. You actually got an error like: "error_id":406, "error_message":"Access token sent over non-HTTPS request, it has been invalidated", "error_name":"access_token_compromised" On the first attempt. Only subsequent attempts, with the same token, would yield the 'key' is not valid for passed 'access_token' error. When I ...


4

The OAuth Domain is either: A valid domain that you own and control, and that is hosted somewhere the client can reach. Say, for example that you owned unicorns.mil. See this answer and this answer for more information on how to configure the app registration settings. (This is "Explicit" or server-side OAuth) OR: Use stackexchange.com. This is a ...


3

There have been no reported changes to the API, officially for many years, (unofficially since January). But, frankly that script's approach should have never worked. OAuth credentials are sent to:     https://stackapps.com/a/7936#access_token=y6rVASxxxxxxxxxRO2R9Bg)) (for example) But this is immediately 302 redirected to:     https://...


3

Yes, calls to /access-tokens/{accessTokens} use API quota. You can see that by repeatedly running /2.2/access-tokens/XBWL0stf*YIOCl7WpJHqYA)) for example. With each call, the quota_remaining value will decrease. However, there is no reason that the token check has to use the same key as your main app. The token check and your main app would then use ...


3

Turns out this is completely my fault :/ I overlooked the expiry aspect of the access token which meant that I got the default 86399 seconds (~24 hours), which meant my users had to get a new access token every day. Because this is a userscript which is used daily, it makes sense to have a no_expiry scope so that the user doesn't have to repeatedly ...


3

You got that error because you set the OAuth Domain like example.com:8080, not the redirect_uri. That's not how you configure non-standard ports; see below. The redirect uri, with port, feature now works (it didn't once upon a time). To use, adjust your app settings: Go to https://stackapps.com/apps/oauth and click on your desired app. Click the "Edit ...


2

So, this was a fun one. :) We apparently broke several different things over the course of a year that went unnoticed until Google turned off OpenID support. In no particular order but for fun and posterity: Facebook OAuth authentication just straight up didn't work. It broke back in January of 2014 when the code was accidentally changed from function ...


2

Yes, each time you invoke stackexchange.com/oauth/ you will get a fresh access token, even though old ones may still be valid. For example: Go to /me/inboxLivedoc and hit Get Token twice, recording the token value each time (It will always be different). Then go to /access-tokens/{accessTokens}Livedoc and check each token. They will both still be valid! (...


2

Dealing with token expiration is pretty simple. When a token is/goes bad then, when you make an API call that uses the token, you will get a JSON response like this: { "error_id": 403, "error_message": "`key` is not valid for passed `access_token`, token not found.", "error_name": "access_denied" } At that point, just re-authenticate. You can ...


2

The question is not clear enough. You appear to be trying to use jQuery to do explicit OAuth from a web page. If so, this is not allowed. Explicit OAuth is for servers. You are not running that code in node.js are you? Anything that runs in the user's browser, like javascript, needs to use "implicit" (Client side) OAuth. Implicit OAuth was developed ...


2

I don't think that's a bug, for implicit OAuth. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks. Use the state parameter. And this works. For example, a call to:   /oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success (Click the link and try it.) Yields ...


2

This is what the /apps/{accessTokens}/de-authenticate route does. Passing valid access_tokens to this method causes the application that created them to be de-authorized by the user associated with each access_token. This will remove the application from their apps tab, and cause all other existing access_tokens to be destroyed. (Emphasis added) So if ...


1

Refer to the API Authentication docs; there are a great many things wrong with the URL in the question (at least 5). For starters, it's to the wrong path. stackoverflow.com/oauth/authorize gives helpful messages/results like: Oops! Something Bad Happened! Authorization attempt not valid for current user Authorization attempt unauthorized Couldn'...


1

I get the reason: Do not use gem 'omniauth-stackexchange', '~> 0.2.1' ,but instead of gem 'omniauth-stackexchange', git: 'https://github.com/nashby/omniauth-stackexchange.git' The reason see this:add call back url


1

I don't know about that Ruby/Gem, but your app registration is not correct. You need to configure your app for explicit OAuth2, per this other answer, except enter localhost instead of example.com. (The localhost is based on the original version of the question. If you have a registered domain, use that.) Then, in your ruby code: config.omniauth: ...


1

You can do this using the /me endpoint or the /me/associated endpoint. /me Returns the user associated with the passed access_token. Use this if you want to get user info for a specific site (e.g. StackOverflow). /me/associated Returns all of a user's associated accounts, given an access_token for them. Use this if you want to get user info for all ...


1

Unpack response content with $response->getBody()->getContents(). use GuzzleHttp\Client; Route::get('/approve', function () { header('Location: https://stackexchange.com/oauth?client_id=12345&scope=write_access&redirect_uri=https://mysite.com/approved'); }); Route::get('/approved', function (Request $request) { $client = new Client(); ...


1

What software are you using? Anyway, for a Desktop app, you almost always use the "Implicit" (Client side) procedure. Configure your Stack app as shown in this answer. That dialog appears to be set for "Implicit" (server side) OAuth. Unless it is acting as -- or on -- a full web server, this is incorrect. Attempt to set it for client side OAuth. In that ...


1

I had to change the structure of Authentication on my App. For windows 10, I use AuthenticationBroker but for Windows 10 Phone I used the old WebView Model and completed login implementation.


1

Refer to the generic URI syntax, it is perfectly valid to have a fragment (The optional part of a URL that starts with an octothorpe #) without a preceding query (The optional part of a URL that starts with a question mark ?). This is how Stack Exchange returns tokens and other API's have used the same approach. There is nothing wrong with it. In fact, it ...


1

The authentication process is described in the API docs: http://api.stackexchange.com/docs/authentication.


1

That error means that you've used an invalid id or that the settings on your app page are incorrect. Do the following: Go to Your Apps page. You should see your app listed. If it is not, then register a new app. Click on your app's settings page. For example: stackapps.com/apps/oauth/view/3996. Note that only the owner can see a given app's settings ...


1

I had the same problem. According to the authentication docs‡: In order to get access_token and expires (if applicable) wrapped in a JSON object, POST to https://stackoverflow.com/oauth/access_token/json instead. ‡ Now. The Doc pages did not say this back in 2013.


Only top voted, non community-wiki answers of a minimum length are eligible