i’m not sure if there’s been an intentional change lately to the system related to authorization flows, but it seems like something has changed. i have a couple of single-page web applications that i made back in the day that utilize the PCKE authorization flow: just displays the logged-in iNat u…

As far as I can tell nothing has changed and this is the way OAuth is supposed to work: the client asks for an authorization code, and if the resource owner grants permission, the server delivers the authorization code to the client which the client then uses to request an access token, but that cod…

hmmm… just based on how i remember iNat’s PKCE flow working, i thought that for each authorization request, the system was just referring back to the user’s original authorization decision, if it existed, rather than asking the user to authorize every time. (after all, you do keep a record of which …

Previously authorized 3rd party apps still require reauthorization

General

Topic		Replies	Views
API authentication help General	7	669	October 6, 2023
Application API key revoked? General api	7	507	September 26, 2023
Add column to show count of users who have authorized each third-party app Feature Requests	3	180	September 16, 2025
Add a line to API Docs about Personal API Tokens General	5	254	January 5, 2025
Trouble getting /oauth/token to work General web , question , api	6	780	May 29, 2021

Previously authorized 3rd party apps still require reauthorization

Related topics