The Stack Overflow OAuth endpoints (https://stackoverflow.com/oauth/access_token/ and https://stackoverflow.com/oauth/access_token/json) have started responding to requests from the server I run my projects on with 403s and a Cloudflare CAPTCHA page, meaning users are unable to log in. This issue seems very similar to New Cloudflare protection breaking important bots.

  • Oddly, using wget to manually POST to the endpoints (from the same server) and providing a browser UA works correctly, returning a JSON error.
    – Ginger
    Feb 9 at 14:45
  • Feels similar to this: stackapps.com/questions/10497/…
    – rene
    Feb 9 at 14:54
  • 1
    A UserAgent that is long enough is needed, indeed.
    – rene
    Feb 9 at 14:57
  • New report on Stack Apps as well: stackapps.com/questions/10513/…
    – rene
    Feb 16 at 7:59
  • This appears to have expanded to the rest of the site as well, unfortunately. I've contacted SE personally, but haven't gotten a response yet.
    – Ginger
    Feb 20 at 15:43
  • Yeah, I status-reviewed the reports on Stack Apps already. Let me check if an MSE mod is around to discuss if adding more status-review tags will help.
    – rene
    Feb 20 at 16:03
  • 7
    I've been informed that the dev-team has the tickets on their board, I've not been given an ETA so it remains a waiting game.
    – rene
    Feb 20 at 18:24
  • Almost "me too!" I have the same problem but with a new personal project. In the meantime, when this issue is solved, I'm experimenting with Auth0. So far, it's working fine for my use case.
    – Rubén
    Feb 20 at 19:30
  • 1
    Possibly related? meta.stackexchange.com/questions/398192/…
    – tripleee
    Mar 2 at 8:50

1 Answer 1


Sorry it took a while to get to me and then hunt down the issue but it should now be resolved. Part of the issue is that the managed challenge from Cloudflare was intermittent, making tracking down the root issue difficult.

  • 6
    You really should make an account on Stack Apps. We have plenty of questions for you to answer .... ;)
    – rene
    May 14 at 19:51
  • Does this apply for the network login pages as well? My bots use them to get a chat token, since there's no official API.
    – Ginger
    May 15 at 22:59
  • @Ginger what's the domain / path for the network login your bot is using?
    – Josh Zhang StaffMod
    May 16 at 11:51
  • @JoshZhang The login code is available here, but it effectively runs through the entire SE login process as if it were a human (since that's the only way to get a chat token).
    – Ginger
    May 16 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .