So if a user has 6 apps running it is possible that 6th app will share my apps 10k limit, and the quota_remaining would decrease by more than one between requests?

tbh, In the same way StackExchange is not a good design for a forum (or at least thats whats said), it is not a good design for listing apps and libraries. I know you created a site to list them in a much better format, but it is not as well known as StackApps, (which Im guessing is one the least known sites in the network). The apps tab has gotten by, but instead of forcing it, and "patching" on features to do what is needed, your site (after a design to match stack apps)or something like it, should be made the stack apps homepage.

well then the problem is different, because I created that account to make sure the Facebook login page fitted in the iPhone screen without scrolling (a long time ago, when you could only have 2 open IDs per account). I logged out of that account on this computer before, never used the API with it. Logout says it will log you out on all devices, is that except the API?

try this access token (I know I shouldn't post it, but it should become invalid after this is resoled) rgsA**R6lO5aseFSVy6JBg)) on the inbox docs page

Yes I know the first sentence, I am specifically denying the apps, then using the API. I noticed this about 10-15 minutes before I noticed the other zero items bug, but posted both at the same time so I had time to make sure it wasn't caching or anything. It is still a problem at the moment. Maybe the API releases I am not authorised to access the inbox (hence the zero items), but it is not realising that it should be returning an error, and showing the dialog.

@Kevin, I thought that a while ago the network was updated so that users only have one profile, which was pushed between sites? There used to be a button called "copy profile from stack overflow", which has now disappeared?

Ok so if an invalid Access Token is used, the API will return an error, it is then up to the app to run the user through the auth process again. The app does so, if the user is logged in already and the app is still authorised, the auth flow will invisibly use the cookies/local storage/etc, or otherwise present the OAuth dialog, right? If I've got that right then it make it much clearer so thanks :)

I know, I mean after invalidating an access token, if it tries to access a method using an invalid access token, it will not just get a new access token. because the server is not storing the user's cookies, global login etc.

so it only applies to implicit flow?

Also if an app is given a new access token, how does the API know which user to give this access token for?

Thanks Kevin, sorry about not quite understanding this. One thing I still don't understand is that whats the point of invalidating an access token, if the app is simply given a new access token, the old one might as well be kept?

For a server, I figured it would be more secure to get the access token from the server, rather than have the client download the access token directly and then upload it? But having just said that made me realise that then the client won't be able to use the access token. Tbh I wasn't sure what the point of the explicit flow was?