API Error when connecting apps

[mark-ellul]

Up until yesterday the oAuth was working fine. Late yesterday (European time) when clicking on accept the page was getting to redirected to the below address, with a error message "API error"

https://www.khanacademy.org/api/auth2/authorize

I have tried with different Khan Academy accounts and the issue occurs on all of them.

Any help would be very much appreciated.

[mark-ellul]

I also tried with different API keys, and the same error occurs

[benjaminjkraft]

I don't think there were any changes to this code recently, so I'm not sure what would have changed -- can you post a more specific description of what requests you're making, so we can try to figure out what's going on?

[mark-ellul]

We are using a php oAuth library (http://code.google.com/p/oauth-php/) that was working Wednesday. Yesterday, something broke, when we get redirected to Khan Academy, https://www.khanacademy.org/login/oauth/approval?oauth_token=t5460145942691840&embedded=1 we are shown the normal "Accept Page" (if the user is logged in) and upon clicking accept we get the error. See http://g.recordit.co/sStNzLdI6z.gif as an example.

[benjaminjkraft]

Thanks. We've had at least one other report of a similar issue -- I've opened a ticket in our internal tracker and hopefully someone will be taking a look at it soon.

[carterjbastian]

Hi Mark. I'm taking a look at this issue right now. Can you tell me where you were making these API requests from? That will help me find isolated incidences of this specific error.

[mark-ellul]

Hi Carter,

We are making these API requests from qa.cityoflearning.me and chicago.cityoflearning.me.

Is that what you need to know?

[carterjbastian]

Yes thank, you. I've noticed that when I click the "Accept" button to link my KA account, the Request Header does not include an oauth_callback parameter. This is what's causing the API error you're noticing.

Specifically, the Request Header formed looks something like this: https://www.khanacademy.org/api/auth/request_token?oauth_callback=&oauth_signature_method=HMAC-SHA1&oauth_signature=YQVUg7Mf8dt2McGzRvBhi5wYFd0%3D&oauth_nonce=576c73de9deb2&oauth_timestamp=1466725342&oauth_consumer_key=tC5aD2QLFy3Zh9yr&oauth_version=1.0

Is this intentional?

[carterjbastian]

Sorry, looking back over my comment, it's not the "Accept" button, but rather the "Link Account" button that's from my profile page.

[mark-ellul]

Hi Carter, Thanks for pointing that out, there was some clean up of code that must of removed that value from the Request Header. Now that code has been put back it's all working again. Thanks and Regards Mark