Help talk:OAuth

About this board

Daß Wölf (talkcontribs)

If I grant OAuth access to "Library Card", I will apparently share my e-mail address with it. I'm obviously fine with one WMF project seeing the e-mail address I use on another WMF project, but does this mean my e-mail address is shared with The Wikipedia Library partner companies? What other info is shared with these companies? The privacy policy link only leads to the general WMF privacy policy.

BDavis (WMF) (talkcontribs)

This is a question specific to the particular OAuth Application and not the general OAuth service. It can only be answered by someone with knowledge of the application itself. I believe that the "Data Retention and Handling" section covers your question, but I encourage you to contact the project directly if you have further concerns.

Reply to "Library Card and privacy"

how do i search for application name with OAuth

2 (talkcontribs)

how do i search for application name with OAuth

Tgr (WMF) (talkcontribs)
Reply to "how do i search for application name with OAuth"
Oalexander (talkcontribs)

Checking my "Manage connected applications" page after having been notified of a failed login attempt under a new device I have found out that a "Library Card [1.6]" (Publisher: Jsn.sherman) is connected to my account by using the OAuth protocol. Could somebody pls. advise me what this means? Thanks. ~~~~

Tgr (WMF) (talkcontribs)

That you have at some point logged into The Wikipedia Library Card Platform, and as part of the process authorized it to read your identity and email address on the Wikimedia sites. It's not related to failed logins in any way.

Restrictions for new accounts ?

Simon Villeneuve (talkcontribs)


I plan to show how to use mix'n'match to a group of newbies and I want to know if there's restrictions for using OAuth for new accounts (like "only autoconfirmed shall pass").

Iluvatar (talkcontribs)

There are no restrictions to users (see that — new acc, no edits, no flags), but developers of tools might add any restrictions in own source code. Sorry for my English.

Tgr (WMF) (talkcontribs)

There might be unintentional limitations coming from the fact that requests through that tool all use the same IP. So if something has an IP-level rate limit for non-autoconfirmed accounts (and several things do, e.g. 8 edits per minute), that will apply. Although for an IRL presentation with everyone using the same internet connection, such limitations would apply to non-OAuth actions as well.

Simon Villeneuve (talkcontribs)
Reply to "Restrictions for new accounts ?"
Magnus Manske (talkcontribs)

So, how do I register my application? It seems like that's a thing that should be mentioned on the Help page...

Magnus Manske (talkcontribs)

Never mind, found it, and added to the Help page.

Deskana (WMF) (talkcontribs)

Hi Magnus,

Thanks for adding that link. It's possible I might make a help page for OAuth developers in the future which we can put that on, but for now I think it's helpful to have on the main help page.

Your application's already been approved. Let me know if I can help more.

This post was posted by Deskana (WMF), but signed as DGarry (WMF). (talkcontribs)

Ok thanx

How can my application yichengtry [1.1] be approved?

Anorange0409 (talkcontribs)

I registered this application on 20 June, is there any thing I need to do to get an approval?

GZWDer (talkcontribs)

You can just use it, but it is currently not useful, since you don't make "Edit existing pages" applicable to consumer.

Ddennedy (talkcontribs)

I would like an answer to this too. I have a consumer for "Video Editing Server" that was proposed 10 days ago, and it is still not approved. In its proposed state, only my user account can use it to let the app get an access token. This is inhibiting other people from developing and testing.

fatal error logging into QuickStatements2

Summary by BDavis (WMF)

Bug report for a Toolforge tool. Not globally relevant.

Trilotat (talkcontribs)

<b>Fatal error</b>: Uncaught Exception: Error retrieving token1: {&amp;quot;error&amp;quot;:&amp;quot;mwoauth-callback-not-oob-or-prefix&amp;quot;,&amp;quot;message&amp;quot;:&amp;quot;oauth_callback must be set, and must be set to \&amp;quot;oob\&amp;quot; (case-sensitive), or the configured callback must be a prefix of the supplied callback.&amp;quot;,&amp;quot;callback&amp;quot;:&amp;quot;api.php&amp;quot;} in /data/project/magnustools/public_html/php/oauth.php:283 Stack trace: #0 /data/project/quickstatements/public_html/api.php(103): MW_OAuth-&gt;doAuthorizationRedirect('api.php') #1 {main} thrown in <b>/data/project/magnustools/public_html/php/oauth.php</b> on line <b>283</b><br /

I have used quickstatements successfully. I had to clear cookies for other issues and now cannot relogin. I deauthorized and now cannot use at all.

BDavis (WMF) (talkcontribs)
Adam (Wiki Ed) (talkcontribs)

~Is there some clarification on where/why Oauth is disabled for blocked IPs. I'm seeing some failed login attempts for unblocked users operating on schoolblocked IPs and I want to know what the exact check is. thanks.

CSteipp (WMF) (talkcontribs)

Hi Adam, users shouldn't (can't) use OAuth to login-- the login api calls are explicitly disabled. Are you seeing failures when potential users are logging in to authorize the Consumer? Or is the Consumer's api calls failing, because it's running from a blocked IP?

Adam (Wiki Ed) (talkcontribs)

@CSteipp (WMF) thanks for the reply and sorry for not noticing it. I'm talking about the latter, (API calls failing). They're logged in or reported as much.

Tgr (WMF) (talkcontribs)

Blocking will work the same way for OAuth requests as normal requests (but keep in mind that the IP will be that of the server hosting the OAuth application, not the real user).

Some plans to make block handling more flexible are in T159889 and T110249.

Reply to "Login from blocked IP"

How do I print a Wikipedia biography?

Summary by Tgr


2600:1014:B1B8:18C3:68A9:E0F4:CD5E:53E (talkcontribs)

How do I print a Wikipedia biography?

Tgr (talkcontribs)

By clicking the "Print" icon in your browser, probably?

Definitely not by asking about it on a completely unrelated talk page.

Differentiate Oauth 1.0a and Oauth 2.0

Xinbenlv (talkcontribs)

Since Oauth 1.0a and Oauth 2.0 are practically two different protocols, shall we make it more explicit what version it refer to here? I am a bit confused...

Tgr (WMF) (talkcontribs)

This is user documentation; there's not that much difference from a user's point of view. The developer documentation does discuss them separately.

Reply to "Differentiate Oauth 1.0a and Oauth 2.0"
Return to "OAuth" page.