We just posted our site destinygearsets.com on reddit yesterday to pretty much a complete fail. Originally we were using phantomjs to hit bungie, log in, and grab cookies which got returned to the php server and stored in the session. Us devs working on it could auth just fine but in alpha, asking friends to use it, xbox auth failed every time. I was fortunate enough to get a few friends' xbox login creds, finally figured out that if I went to freakin MS live site, logged in, deleted the bungie app from their "allowed apps", went to bungie, logged in with their creds, and re-approved bungie/destiny app with Live, all of a sudden everything worked fine! This is a UX nightmare, so we refactored our auth process, went with the straight PHP approach from the wiki thinking, "hey open source must work, let's just use this" and everything seemed fine (because with every login we had, we had already gone thru the process of unauthorizing destiny app and reauthorizing). Fast forward to yesterday and no new users could auth for Xbox only. PSN users could use the site just fine. Incredibly embarrassing ego-smash aside, at this point we're still unsure as to why or what exactly we're going to have to fix to make everything play nice. Good ol' "prod-only" bugs right? Ugh. There's so much good in that API and so much "well wtf?!" We posted our auth code https://www.reddit.com/r/DestinyGearsets/comments/38j9ob/whats_with_this_bungie_auth/ for transparency but I'd really appreciate any help on why we're consistently unable to have new users be able to properly auth for Live. Without bungie providing actual oauth tools and a proper platform for third-party authentication, we're pretty much stumped. Yes, yes, "we dont support third-party auth" but with the wealth of other sites doing this, we've got to be missing something. Any help is greatly appreciated! Thanks guys!