New
Oct 11, 2022 6:33 AM
#151
f4b10 said: Hello there, new here and new to programming. I am trying to simulate responses from the API endpoints with postman. I have managed to get data from the public endpoints and the user anime's list. However I cannot use the 'get user' endpoint since it requires OAuth 2.0. Can anyone or @ZeroCrystal show me an example of how to do a postman GET request of the endpoint (https://api.myanimelist.net/v2/users/{user_name})? The docs are quite overwhelming for beginners and I feel like they could be more explicit. Whenever I fill postman's authorization tab with the info I got I get a {"error":"invalid_client","message":"Client authentication failed"} message when trying to get a new access token. Hi! I'll assume that you already have an Access Token since you'll need it to call any "private" endpoint. There's probably a specific option in Postman, but the easiest way to call such endpoints is to add an HTTP header named "Authorization" with the value "Bearer XXX" (where XXX is your Access Token). For example: URL GET https://api.myanimelist.net/v2/users/@me?fields=id,name,anime_statistics Headers Authorization: Bearer a1b2c3d4 Response { "id": 5292566, "name": "ZeroCrystal", [...], "anime_statistics": { "num_items_watching": 8, "num_items_completed": 718, [...], "mean_score": 6.48 } } |
Oct 11, 2022 7:29 AM
#152
ZeroCrystal said: f4b10 said: Hello there, new here and new to programming. I am trying to simulate responses from the API endpoints with postman. I have managed to get data from the public endpoints and the user anime's list. However I cannot use the 'get user' endpoint since it requires OAuth 2.0. Can anyone or @ZeroCrystal show me an example of how to do a postman GET request of the endpoint (https://api.myanimelist.net/v2/users/{user_name})? The docs are quite overwhelming for beginners and I feel like they could be more explicit. Whenever I fill postman's authorization tab with the info I got I get a {"error":"invalid_client","message":"Client authentication failed"} message when trying to get a new access token. Hi! I'll assume that you already have an Access Token since you'll need it to call any "private" endpoint. There's probably a specific option in Postman, but the easiest way to call such endpoints is to add an HTTP header named "Authorization" with the value "Bearer XXX" (where XXX is your Access Token). For example: URL GET https://api.myanimelist.net/v2/users/@me?fields=id,name,anime_statistics Headers Authorization: Bearer a1b2c3d4 Response { "id": 5292566, "name": "ZeroCrystal", [...], "anime_statistics": { "num_items_watching": 8, "num_items_completed": 718, [...], "mean_score": 6.48 } } Thank you for the reply ZeroCrystal. However, I don't have an Access token, I am struggling with that since I don't know how to get it and when I registered the client ID I didn't get any other info just the client secret and the ID. |
Oct 11, 2022 7:50 AM
#153
f4b10 said: Thank you for the reply ZeroCrystal. However, I don't have an Access token, I am struggling with that since I don't know how to get it and when I registered the client ID I didn't get any other info just the client secret and the ID. I see. Did you try following my guide (here) or the official documentation? |
Oct 12, 2022 3:51 PM
#154
ZeroCrystal said: f4b10 said: Thank you for the reply ZeroCrystal. However, I don't have an Access token, I am struggling with that since I don't know how to get it and when I registered the client ID I didn't get any other info just the client secret and the ID. I see. Did you try following my guide (here) or the official documentation? After re-reading I have realised that I was messing up on step 2 and thinking it was step 4. My bad! On step 2 the preview page I get is a login/signup page instead of the allow access page, is this normal? |
Oct 13, 2022 5:20 AM
#155
f4b10 said: After re-reading I have realised that I was messing up on step 2 and thinking it was step 4. My bad! On step 2 the preview page I get is a login/signup page instead of the allow access page, is this normal? No, if you're getting a pop-up asking for your username and password it means that you mistyped one of the parameters. The most common mistake is passing a different redirect_uri from the one you set on the API panel. It must be exactly the same string, so pay attention to pending slashes in the URL and the protocol used (http:// vs https://). |
Oct 13, 2022 5:25 AM
#156
Just to be clear: did you get a standard pop-up like the one shown below or a regular HTML page with MAL's logo? |
Nov 12, 2022 4:19 PM
#157
ZeroCrystal said: Just to be clear: did you get a standard pop-up like the one shown below or a regular HTML page with MAL's logo? Apologies for the late answer! It shows a pop up image from MaL but not this one. I decided to put this project on hold. |
Nov 13, 2022 8:53 AM
#158
f4b10 said: Apologies for the late answer! It shows a pop up image from MaL but not this one. I decided to put this project on hold. That's the regular login screen. You must be logged in to approve the request. It's easier if you open that link on your browser rather than using Postman, and then use the returned authorization code to get your Access Token. |
Mar 5, 2023 9:50 PM
#159
After calling https://myanimelist.net/v1/oauth2/authorize?response_type=code&client_id={my_client_id}&code_challenge={my_challenge_code} I get to the Mal login page but when I enter in my credentials I get the 400 error, I am getting redirected to a page saying "400 Bad Request" (https://myanimelist.net/login.php?from=%2Fdialog%2Fauthorization) I do see an error on the login in page though that says " Localhost is not in the list of supported domains for this site key. " I can't figure out if this is the cause of my 400 Error Not sure if anyone else using a webapp has had this issue |
blackanimegirlMar 5, 2023 10:00 PM
Mar 6, 2023 7:58 AM
#160
Hi @blackanimegirl! I have a few questions: what are the redirect URLs you added on the API panel? More specifically, how are you opening the login page? Are you using your web browser? What kind of application are you building? localhost is a valid redirect URL, so I guess you've misconfigured something on your end. |
Mar 6, 2023 8:52 AM
#161
Hello @ZeroCrystal. Thanks for the quick response In my settings I have the url http://localhost:8080/authenticated listed as a redirect uri I'm opening the login page on the chrome browser and I'm building a webapp I also think there might be something wrong with my configuration Also that error about localhost is coming from a captcha? |
blackanimegirlMar 6, 2023 5:34 PM
Mar 6, 2023 11:34 AM
#162
This is a reCAPTCHA-related error message, so I'm not sure you're using the API properly. How do you listen for the incoming request sent when a user authorises your application? I don't think you can add a custom HTTP listener straight into the browser. |
Mar 6, 2023 5:48 PM
#163
the url http://localhost:8080/authenticated is another endpoint my backend (running locally) is expecting the redirect to come to so I can get the authorization code. Maybe this isn't the correct assumption This is what my config looks like in mal |
blackanimegirlMar 6, 2023 10:29 PM
Mar 7, 2023 9:01 AM
#164
blackanimegirl said: This is what my config looks like in mal Everything looks fine in the API panel. Can you share with us the code you're running to manage the authentication process? |
Mar 8, 2023 6:25 AM
#165
Ayoo Friends, I got a question maybe one of you could help me! I am trying to generate an access token on postman but everytime i receive 400 Bad Request. { "error": "unsupported_grant_type", "message": "The authorization grant type is not supported by the authorization server.", "hint": "Check the `grant_type` parameter" } i am not sure whats wrong. I tried to follow every step but after user authorization I put the receive code into the parameter "code" and sent the POST request. Everytime it fails... not sure what to do... should the grant_type just be "authorization_code", right?[font="Inter, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Oxygen, Ubuntu, Cantarell, \"Fira Sans\", \"Droid Sans\", Helvetica, Arial, sans-serif"] Help me please TT^TT[/font] |
EzevkyxMar 8, 2023 9:44 AM
Mar 8, 2023 1:25 PM
#166
Ezevkyx said: I am trying to generate an access token on postman but everytime i receive 400 Bad Request. Hi! Can you send a screenshot of the request's body? (Please, redact your Client ID/Secret before posting) Also, how many redirect URLs did you set on the API panel here on MAL? |
Mar 9, 2023 4:45 AM
#167
ZeroCrystal said: Thank you for your reply!Ezevkyx said: I am trying to generate an access token on postman but everytime i receive 400 Bad Request. Hi! Can you send a screenshot of the request's body? (Please, redact your Client ID/Secret before posting) Also, how many redirect URLs did you set on the API panel here on MAL? I only set up one URL to my GitHub. After redirected I received the code and followed the next steps ... unssuccessfull... |
EzevkyxMar 9, 2023 4:56 AM
Mar 9, 2023 5:00 AM
#168
@Ezevkyx, your issue is very simple: you're sending all the parameters as part of the URL's query string, which is wrong. Instead, they must be form-URL encoded and sent as part of the body of the POST request. In Postman, you can achieve this by moving them to the Body tab and selecting x-www-form-urlencoded. |
Mar 9, 2023 8:44 AM
#169
@ZeroCrystal Thank you so much! I am so stupid... I didnt thought about this xD |
Mar 9, 2023 9:43 AM
#170
Hello everyone! Is OAuth2.0 the only authentication method available? I was trying to create a Console Application to retrieve data related to my user and I was wondering if I could achieve that with the basic client_credentials flow. Can anyone or @ZeroCrystal help me with this? |
Mrx3110Mar 9, 2023 9:50 AM
Mar 9, 2023 11:05 AM
#171
Mrx3110 said: Is OAuth2.0 the only authentication method available? I was trying to create a Console Application to retrieve data related to my user and I was wondering if I could achieve that with the basic client_credentials flow. Hi! It depends on what kind of information you need. Anime and manga lists can be accessed without authentication (read here), but profile/account information can only be retrieved using an Access Token. |
Mar 9, 2023 11:11 AM
#172
Mrx3110 said: Thanks for the reply! I'd like to access a set of user informations, but since I'd be doing that using a console app I was wondering if I can retrieve an access token using the standard client_credential flow instead of oauth2 ZeroCrystal said: Mrx3110 said: Is OAuth2.0 the only authentication method available? I was trying to create a Console Application to retrieve data related to my user and I was wondering if I could achieve that with the basic client_credentials flow. Hi! It depends on what kind of information you need. Anime and manga lists can be accessed without authentication (read here), but profile/account information can only be retrieved using an Access Token. Thanks for the reply! I'd like to access a set of user informations, but since I'd be doing that using a console app I was wondering if I can retrieve an access token using the standard client_credential flow instead of oauth2 |
Mar 9, 2023 12:25 PM
#173
Mrx3110 said: I'd like to access a set of user informations, but since I'd be doing that using a console app I was wondering if I can retrieve an access token using the standard client_credential flow instead of oauth2 Unfortunately, the client credentials flow is unsupported by MAL. If the token-less alternative I've linked in my previous post doesn't fit your needs, this is the general procedure you can follow to build a native application:
If you don't wish to implement an HTTP server you can simply ask your users to manually copy-paste the authorisation code into your application. Either way, this entire procedure only has to be carried out once. After obtaining your access and refresh tokens, you can keep using them for as long as needed. |
May 25, 2023 9:16 AM
#174
Hi :) I'm trying to build a webapp with the API and Ruby on Rails and I face some of the same problems that have already been discussed here. This comment made me curious. Does this mean that this pkce generator that I coded is wrong: def generate_code_verifier verifier = SecureRandom.urlsafe_base64(64).gsub(/[^A-Za-z0-9\-._~]/, '') verifier[0...128] # Ensure the verifier length is between 43 and 128 characters end def generate_code_challenge(verifier) base64_url_encoded_sha256 = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier)).gsub(/[^A-Za-z0-9\-._~]/, '') base64_url_encoded_sha256[0...128] # Ensure the challenge length is between 43 and 128 charactersend end Do I only need the code_verifier and set it as the challenge and verifier that I use later? |
May 26, 2023 5:18 AM
#175
nikitaku said: Do I only need the code_verifier and set it as the challenge and verifier that I use later? Hi! Your intuition is correct. Currently, MAL only supports the plain code challenge method. In short, the code verifier and the code challenge must be the same string. You don't have to hash anything. |
Jun 19, 2023 12:16 PM
#176
EDIT: it looks like you solved it by yourself :) @lowzyyy: Unfortunately, you cannot use the API straight from your browser as the server doesn't return the appropriate CORS headers. On the other hand, you shouldn't have any problem using Node.js or any other kind of back-end. Your issue is that you are JSON-encoding the body of the second request, but it must be form-URL encoded (e.g. using URLSearchParams or any alternative method to format it). |
Jun 19, 2023 12:51 PM
#177
ZeroCrystal said: On the other hand, you shouldn't have any problem using Node.js or any other kind of back-end. Your issue is that you are JSON-encoding the body of the second request, but it must be form-URL encoded (e.g. using URLSearchParams or any alternative method to format it). Thanks, even with urlsearchparams i get the same 400 error: |
Jun 19, 2023 12:57 PM
#178
lowzyyy said: Thanks, even with urlsearchparams i get the same 400 error The response body should contain a more precise error message, can you show it to me? Also, how many redirect URLs did you set on the API panel? |
Jun 19, 2023 1:29 PM
#179
ZeroCrystal said: The response body should contain a more precise error message, can you show it to me? Also, how many redirect URLs did you set on the API panel? I did set http://localhost/oauth Found the problem. When you are getting code you have to use the same verifier but i generated new verifier at every start of the app and i was getting the error from curl {"error":"invalid_request","message":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.","hint":"Authorization code has expired"} |
lowzyyyJun 19, 2023 2:13 PM
Jun 19, 2023 2:21 PM
#180
lowzyyy said: Found the problem. When you are getting code you have to use the same verifier but i generated new verifier at every start of the app and i was getting the error from curl {"error":"invalid_request","message":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.","hint":"Authorization code has expired"} Great. The code verifier/challenge must be the same for both requests, but it's also important to remember that the authorization code (the code field) has a very short lifetime (I believe it expires after five minutes but I should double-check it). You won't be able to issue a new token using an authorization code you obtained e.g. ten minutes ago. |
Jun 20, 2023 9:02 AM
#181
ZeroCrystal said: but it's also important to remember that the authorization code (the code field) has a very short lifetime (I believe it expires after five minutes but I should double-check it). You won't be able to issue a new token using an authorization code you obtained e.g. ten minutes ago. Wait but when my access token expire, i have to refresh it, right? To refresh it i have to send the same request like the first time to get refresh and access tokens just with some different fields? That means i have to authorize again, but i cant authorize unless i use browser to manually click authorize? I dont get it how to refresh token programatically? Edit: actually i menaged to refresh token without sending code and code_verifier, just (client_id, client_secret, grant_type, refresh_token)...Docs are confusing |
lowzyyyJun 20, 2023 9:09 AM
Jun 20, 2023 9:37 AM
#182
lowzyyy said: Edit: actually i menaged to refresh token without sending code and code_verifier, just (client_id, client_secret, grant_type, refresh_token)...Docs are confusing Yep, the documentation can be rather confusing. There's no need for user interaction to refresh a token, it can be automated quite easily. |
Nov 15, 2023 10:58 PM
#183
Nov 16, 2023 6:25 AM
#184
Reply to musubi3
I have managed to successfully get an access token, but I had to copy and paste the authorization code from the redirect URL. I was wondering if there is a way to get the authorization code from the redirect URL without having to copy and paste it?
@musubi3 Hi! It depends on your platform, but if you're developing a desktop or mobile app you have two main options. Before opening the authorization URL in the browser, you can start a local HTTP server and use localhost as your redirect URL. After receiving the token, you can terminate the local server. Alternatively, but this only applies to some devices, you can use private-use URI schemes as your redirect URL so that you don't have to listen for incoming HTTP requests. |
Nov 16, 2023 7:08 PM
#185
Reply to ZeroCrystal
@musubi3 Hi! It depends on your platform, but if you're developing a desktop or mobile app you have two main options.
Before opening the authorization URL in the browser, you can start a local HTTP server and use localhost as your redirect URL. After receiving the token, you can terminate the local server.
Alternatively, but this only applies to some devices, you can use private-use URI schemes as your redirect URL so that you don't have to listen for incoming HTTP requests.
Before opening the authorization URL in the browser, you can start a local HTTP server and use localhost as your redirect URL. After receiving the token, you can terminate the local server.
Alternatively, but this only applies to some devices, you can use private-use URI schemes as your redirect URL so that you don't have to listen for incoming HTTP requests.
@ZeroCrystal Thank you |
Nov 21, 2023 6:02 PM
#186
Reply to Uchuuu
Flash0793 said:
Does anyone know why I keep getting this error when trying to exchange the authorization code for the access token:
{
"error": "unsupported_grant_type",
"message": "The authorization grant type is not supported by the authorization server.",
"hint": "Check the `grant_type` parameter"
}
I'm using Scheme 1 since I don't have a client_secret, and I definitely am putting in the param "grant_type" with the value "authorization_code" like so:
"https://myanimelist.net/v1/oauth2/token?client_id=MY_CLIENT_ID&grant_type=authorization_code&code=MY_AUTH_CODE&code_verifier=MY_CODE_VERIFIER"
Does anyone know why I keep getting this error when trying to exchange the authorization code for the access token:
{
"error": "unsupported_grant_type",
"message": "The authorization grant type is not supported by the authorization server.",
"hint": "Check the `grant_type` parameter"
}
I'm using Scheme 1 since I don't have a client_secret, and I definitely am putting in the param "grant_type" with the value "authorization_code" like so:
"https://myanimelist.net/v1/oauth2/token?client_id=MY_CLIENT_ID&grant_type=authorization_code&code=MY_AUTH_CODE&code_verifier=MY_CODE_VERIFIER"
Just a hunch, but is your verifier the same as your challenge? If it's not, it should be.
@Uchuuu how to get the My_AUTH_CODE and MY_CODE_VERIFIER? |
Nov 22, 2023 8:36 AM
#187
Reply to hatsunemiku97
@Uchuuu how to get the My_AUTH_CODE and MY_CODE_VERIFIER?
@hatsunemiku97 Hi! The Code Verifier and the Code Challenge must be the same string, which has to be randomly generated by your application. The Authorization Code is the one returned by the server after the user has approved your request. Did you check my guide on how to get an Access Token? |
Jun 21, 2024 8:52 PM
#188
Hi! Im trying to implement de MAL Login in my app (for android, in flutter). But i have a problem, that is that after i clic de button to login it takes me to a MyAnimeList page of authorization saying what permissions will have the app, but after i click "Allow", the first time it does nothing, and the second it shows a MyAnimeList page of a 400 error 400 Bad Request Your request produced an error: 400 Bad Request Please return to the previous screen and try again. Back or Continue to MyAnimeList.net. I also tried to insert a link from the app that i copy pasted from my debug console into my computer webBrowser, and does the same, but here, when i see the console browser, it shows an error after i click the "Authorize" button. It is Failed to launch 'myanimelistcollection://callback?code=hereThereAreALotOfLettersAnNumbers' because the scheme does not have a registered handler. If anybody has had this problem before, i would really aprecciate your help. |
KaoriPianoNotesJun 22, 2024 8:04 PM
Jun 22, 2024 7:55 PM
#189
Reply to KaoriPianoNotes
Hi!
Im trying to implement de MAL Login in my app (for android, in flutter).
But i have a problem, that is that after i clic de button to login it takes me to a MyAnimeList page of authorization saying what permissions will have the app, but after i click "Allow", the first time it does nothing, and the second it shows a MyAnimeList page of a 400 error
400 Bad Request
Your request produced an error: 400 Bad Request
Please return to the previous screen and try again.
Back or Continue to MyAnimeList.net.
I also tried to insert a link from the app that i copy pasted from my debug console into my computer webBrowser, and does the same, but here, when i see the console browser, it shows an error after i click the "Authorize" button.
It is
Failed to launch 'myanimelistcollection://callback?code=hereThereAreALotOfLettersAnNumbers' because the scheme does not have a registered handler.
If anybody has had this problem before, i would really aprecciate your help.
Im trying to implement de MAL Login in my app (for android, in flutter).
But i have a problem, that is that after i clic de button to login it takes me to a MyAnimeList page of authorization saying what permissions will have the app, but after i click "Allow", the first time it does nothing, and the second it shows a MyAnimeList page of a 400 error
400 Bad Request
Your request produced an error: 400 Bad Request
Please return to the previous screen and try again.
Back or Continue to MyAnimeList.net.
I also tried to insert a link from the app that i copy pasted from my debug console into my computer webBrowser, and does the same, but here, when i see the console browser, it shows an error after i click the "Authorize" button.
It is
Failed to launch 'myanimelistcollection://callback?code=hereThereAreALotOfLettersAnNumbers' because the scheme does not have a registered handler.
If anybody has had this problem before, i would really aprecciate your help.
KaoriPianoNotes said: If anybody has had this problem before, i would really aprecciate your help. UPDATE: I changed my function to generate the login url to a simplified version String _generateLoginUrl(String verifier) { return '$authorizeUri?response_type=code&client_id=$clientId&code_challenge=$verifier'; } Now when i clic in the button to login, it takes me to the same page of MAL describing that the app will have access to modify your data and all that. However, ir doesn't matter if i clic "Allow" or "Cancel" it will always generates a Platform Exception. When i print in the debug console the platformException it is "PlatformException(CANCELED, User canceled login, null, null)" |
KaoriPianoNotesJun 22, 2024 8:04 PM
Jun 23, 2024 5:05 AM
#190
@KaoriPianoNotes: That sounds weird, but I think it's related to how you set up deep linking in your app. You can read more here: https://docs.flutter.dev/ui/navigation/deep-linking Can you open a simple deep link into your app? It doesn't have to produce any meaningful result, it's just for testing purposes (e.g., myanimelistcollection://test?msg=HelloWorld). |
More topics from this board
» [discontinued] I made a webapp to compare plan-to-watch listsdaux - Apr 16, 2022 |
33 |
by daux
»»
Oct 2, 4:17 PM |
|
» Requesting additional authorizationsSomeNewGuy - Aug 18 |
1 |
by ZeroCrystal
»»
Aug 22, 8:31 AM |
|
» Scraping from HTML suggested rateDavenzo - Jan 8, 2023 |
4 |
by 7k72
»»
Jun 23, 6:35 AM |
|
» Accessing Many Users' Listloukylor - Jun 11 |
0 |
by loukylor
»»
Jun 11, 3:07 PM |
|
» Caching strategy to avoid making additional API callsJakuten - Jun 3 |
4 |
by Jakuten
»»
Jun 8, 11:30 AM |