[SOLVED] Check the "grant

Check the "grant_type" parameter

I am using OAuth 2.0 for authorization according to this documentation :(https://developers.vendhq.com/documentation/oauth.html#oauth) and having this error:

"error": "invalid_request", "error_description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the \"grant_type\" parameter."

Request

Method : POST

Content-Type: application/x-www-form-urlencoded

URL : https://{domain_prefix}.vendhq.com/api/1.0/token

Parameters :

code          = {code}

client_id     = {app_id}

client_secret = {app_secret}

grant_type    = authorization_code

redirect_uri  = {redirect_uri}

Solution

As per the RFC6749, section 4.1.3, the encoded body of a POST request should look like code={code}&client_id={app_id}&client_secret={app_secret}&grant_type=authorization_code&redirect_uri={redirect_uri}.

Example:

grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb&client_id=CLIENT_ID_1234&client_secret=CLIENT_SECRET

Do not forget to encode the redirect Uri: http://foo.bar/ => http%3A%2F%2Ffoo.bar%2F

Concerning the authentication error, it may be because the authorization server does not support client secret in post requests or your client is not allowed to use it (public client). In this case, try to add the Authorization header with basic authentication scheme. The value of this header is Basic {ENCODED_AUTHENTICATION} with {ENCODED_AUTHENTICATION} =base64(client_id + ':' + client_secret)

With this header, the client_id and client_secret in the post request have to be removed. Your request parameters become code={code}&grant_type=authorization_code&redirect_uri={redirect_uri}.