Hot answers tagged

11 votes
Accepted

Unable to get access token

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet. ...
  • 12.7k
11 votes

What exactly is a valid OAuth domain name for registering your app?

The OAuth Domain is either: A valid domain that you own and control, and that is hosted somewhere the client can reach. Say, for example that you owned unicorns.mil. See this answer and this answer ...
  • 12.7k
7 votes
Accepted

Can the redirect_uri contain port number?

You got that error because you set the OAuth Domain like example.com:8080, not the redirect_uri. That's not how you configure non-standard ports; see below. The redirect uri, with port, feature now ...
  • 12.7k
6 votes
Accepted

As a user, where in the web UI could I find all the tokens I have granted for Stack Apps?

Go to your profile: https://stackapps.com/users/current Click the "Edit Profile & Settings" tab: https://stackapps.com/users/edit/current Click "Applications" on the left sidebar (no handy ...
  • 641
5 votes
Accepted

Getting "application not configured for implicit grants" error trying to setup website

Yes, it can be annoying that the API docs, the javascript SDK, and the settings pages use the terms: "Explicit" "Implicit" "Server side" "Client side" a little interchangeably. (The first 2 are ...
  • 12.7k
4 votes
Accepted

Can not request info after OAuth

Your second call must be https:. You actually got an error like: "error_id":406, "error_message":"Access token sent over non-HTTPS request, it has been invalidated", "error_name":"...
  • 12.7k
4 votes
Accepted

Refresh expired acess token basics

Dealing with token expiration is pretty simple. When a token is/goes bad then, when you make an API call that uses the token, you will get a JSON response like this: { "error_id": 403, "...
  • 12.7k
3 votes
Accepted

Access token keeps being invalidated

Turns out this is completely my fault :/ I overlooked the expiry aspect of the access token which meant that I got the default 86399 seconds (~24 hours), which meant my users had to get a new access ...
  • 4,265
3 votes
Accepted

Implicit OAuth flow puts the access token in the hash?

No, you can't get the access_token in the query/search part of the URL. This would be a security leak that would allow 3rd parties to see your access_tokens on the web. Reference: OAuth2.0 Implicit ...
  • 12.7k
3 votes
Accepted

Is there a way to specify how long I want an access token to be valid for?

Yes, I always get 86399 too. And, no, you can't specify an interval other than no_expiry. But you can call /access-tokens/{accessTokens}/invalidateDoc at whatever interval you wish. So, for less ...
  • 12.7k
3 votes
Accepted

iOS Client for stackoverflow always throws redirect_uri not a valid uri

That error means either that you've misconfigured the app or that the authentication call is incorrect. Note that stackexchange.com/oauth/login_success is not a valid redirect_uri irregardless. You ...
  • 12.7k
3 votes
Accepted

Does verifying OAuth2 `access_token` validity count towards API call quota?

Yes, calls to /access-tokens/{accessTokens} use API quota. You can see that by repeatedly running /2.2/access-tokens/XBWL0stf*YIOCl7WpJHqYA)) for example. With each call, the quota_remaining value ...
  • 12.7k
3 votes

Help with javascript SDK configuration

Of course as soon as I finally break down and ask a question I see my mistake: Applications that have the client side flow enabled can use https://stackexchange.com/oauth/login_success as their ...
3 votes
Accepted

Cannot get redirect_uri to work

There have been no reported changes to the API, officially for many years, (unofficially since January). But, frankly that script's approach should have never worked. OAuth credentials are sent to: &...
  • 12.7k
3 votes

Find out whether a user has association bonus

Yes, you can find out if the user has received the association bonus using the API. It's a bit clunky though. However, as we discovered, "association bonus rights" are rather meaningless at the ...
  • 12.7k
3 votes

Creating personal applications using Stack Overflow/Stack Exchange API

If you need something for personal use, it doesn't really matter. You can even use example.com, as long as the site doesn't redirect and change the URL. You'll need a browser and a tool like curl. ...
  • 5,572
3 votes
Accepted

How can I quickly get an access token for personal use?

It's possible to authenticate yourself via the command line; there's no need to set up a website or so. Open the application page via https://stackapps.com/apps/oauth and make sure the option 'Enable ...
  • 5,572
2 votes

Can the redirect_uri contain port number?

Remove the protocol and it should work. On my localhost, I am testing OAuth on a random port and it works fine, while the App setting for redirect_uri is just localhost.
  • 57
2 votes

I Cannot Perform Oauth

The authentication process is described in the API docs: http://api.stackexchange.com/docs/authentication.
  • 358
2 votes
Accepted

Login using Google fails saying OpenID 2.0 accounts for Google has gone away

So, this was a fun one. :) We apparently broke several different things over the course of a year that went unnoticed until Google turned off OpenID support. In no particular order but for fun and ...
  • 358
2 votes

How to programmatically retrieve the access_token from client-side OAuth flow?

In a nutshell and don't know ask me how to write this in C#: That first "500 error" page is normal. You must display that to the user and the user must approve. When the user approves, the page will ...
  • 12.7k
2 votes
Accepted

Same access token between different fetch_token requests

Yes, each time you invoke stackexchange.com/oauth/ you will get a fresh access token, even though old ones may still be valid. For example: Go to /me/inboxLivedoc and hit Get Token twice, recording ...
  • 12.7k
2 votes
Accepted

No 'Access-Control-Allow-Origin' for oauth/access_token

The question is not clear enough. You appear to be trying to use jQuery to do explicit OAuth from a web page. If so, this is not allowed. Explicit OAuth is for servers. You are not running that ...
  • 12.7k
2 votes
Accepted

How to use /me to display my profile data in StackExchange API?

For read requests, you must send the token (and key) in the URL. For example: https://api.stackexchange.com/2.2/me?site=stackoverflow&key=dp55hR5Wr9UhOJReA6F2gg((&access_token=...
  • 12.7k
2 votes
Accepted

I have created a lot of access_token with no_expiry scope while experimenting. How do I delete them?

This is what the /apps/{accessTokens}/de-authenticate route does. Passing valid access_tokens to this method causes the application that created them to be de-authorized by the user associated with ...
  • 12.7k
2 votes
Accepted

OAuth redirect_uri to https://stackexchange.com/oauth/login_success?xxx strips part of the query string

I don't think that's a bug, for implicit OAuth. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks. Use the state parameter. And this works. For ...
  • 12.7k
2 votes
Accepted

`redirect_uri` is not under the registered domain for this application

I don't know about that Ruby/Gem, but your app registration is not correct. You need to configure your app for explicit OAuth2, per this other answer, except enter localhost instead of example.com. ...
  • 12.7k
2 votes
Accepted

App post got deleted

Why is my app post deleted? My guess is that an automated process did this. You can still view the post, just copy the URL from the 'Manage your applications' page. If it has a banner 'deleted by ...
  • 5,572
1 vote
Accepted

Getting an API key for an application without a server

You don't need a server to get an API key, or even to use OAuth2. Set OAuth Domain to: stackexchange.com, and Application Website to: https://stackapps.com/. See this other answer for more ...
  • 12.7k

Only top scored, non community-wiki answers of a minimum length are eligible