Is there no way to acquire a User Access Token without a public web server with HTTPS?

[VOXindie]

Howdy,

I’m trying to make use of certain API endpoints like this one, but I’m having trouble getting a User Access Token.

In previous versions of the API, this could all be done on a local machine via API calls. It seems like the only way to get a User Access Token now is to have a publicly accessible redirect_uri that uses the HTTPS protocol. Is this correct?

If so, this severely inhibits my development process and forces me to pay for a web server just to go through basic development.

[Marenthyu]

What you’re trying to do is still possible - it is based on the environment you are in:

• If you already have your code running on a Server, it should be trivial to access it remotely and thus utilize the Authorization Code Flow
• If you are running your code locally or as a locally-hosted website, you can utilize the Implicit OAuth Flow with a localhost redirect uri to generate a Token. As an example, you can see Barry’s Implicit Auth Example or my PointBar Overlay or, as a “Local App Example”, My LiveSplit plugin for Predictions or my BTD Mod
• If neither of these are an option for you, you can still use the Authorization Code flow by doing the “OAuth Dance” once until you have a token/refreshToken pair, which you can save and then use with the Token Refresh Endpoint once the token expires

[BarryCarlyon]

In addition to the ideas above you can use a reverse tunneling system to provide SSL

A quick start method for this is NGROK https://ngrok.com/ personally I use my live Server and Reverse SSH my local system to it so my live server handles SSL termination.

Then my development environment is more similar to live so testing and development is more realistic to the expected/live environment. For any cookie/session problems.

[VOXindie]

So basically the workaround is to register and use localhost as the redirect_uri?

[BarryCarlyon]

That only works if your dev environment is at http://localhost in order to capture the token.

Manually jiggerpokey of the token handling logic not withstanding