I'm trying to use the refresh_token to (obviously) refresh the Spotify access_token I have. The documentation gives this as an example curl statement:
curl -H "Authorization: Basic ZjM4Zj...Y0MzE=" -d grant_type=refresh_token -d refresh_token=NgAagA...NUm_SHo https://accounts.spotify.com/api/token
and here is my Python implemtation:
payload = {
'grant_type': 'refresh_token',
'refresh_token': <REFRESH_TOKEN>
}
r = requests.post('https://accounts.spotify.com/api/token', data=payload,
headers={'Authorization': 'Basic <CLIENT_SECRET>'})
In both cases I get back {"error":"invalid_client"}
I've tried passing my client_id and the client_secret in the post data but I always get back invalid_client. Someone here on SO said I need to pass in code, but code is a single use, very short lived object that has already been consumed/expired.
Any thoughts to what I'm doing wrong?
The only problem I can see is that you write:
headers={'Authorization': 'Basic <CLIENT_SECRET>'}
when it, using your notation, should be:
headers={'Authorization': 'Basic ' + base64.b64encode('<CLIENT_ID>:<CLIENT_SECRET>')}
However, that could be simplifed further since you are using requests. As described here: http://docs.python-requests.org/en/latest/user/authentication/ Just remove headers and replace it with auth instead:
auth=('<CLIENT_ID>', '<CLIENT_SECRET>')
However, I guess that this isn't what is actually wrong in your code either, since you somehow managed to get a refresh token which requires that you authorized successfully once before.
Related
I am writing a SmartHome skill and need an access token to post asyncrhonous notifications for a device (doorbell). The documentation is confusing - but from what I have infered - I am supposed to get my client_id and client_secret from the Alexa console, and get the Bearer Token during the initial skill connection/authorization, then request the access token (and refresh token) via OAuth. So I can get these three pieces of info, but then I try to do:
curl -vv X POST -H 'Content-Type: application/x-www-form-urlencoded;charset=UTF-8' -d "\
grant_type=authorization_code\
&code=$CODE\
&client_id=$CLIENT_ID\
&client_secret=$CLIENT_SECRET" \
https://api.amazon.com/auth/o2/token
Where CODE came from the initial authorization request as:
"payload": {
"grant": {
"code": "<<REDACTED>>",
"type": "OAuth2.AuthorizationCode"
},
But this always gives me:
{"error_description":"The request has an invalid parameter : code","error":"invalid_grant"}
If I remove the code parameter it complains it's missing, and if I change the code to something invalid, the error changes from invalid_grant to invalid_request. So it understands the code - but doesn't like something about this whole flow.
(I know the client_id, client_secret and grant_types are valid, because when I change them to something deliberately erroneous, I get some expected error).
Any idea what I'm doing wrong??
The code can only be used once - whether it succeeds or not. So even if you use it and your request is botched or otherwise doesn't work - you cannot reuse it. The only was I was able to handle this was to disable the skill, re-enabled it, then snoop and use the new code given.
Both GET and POST methods supported by the endpoint. The POST method is recommended to call endpoint with a huge number of user ids to follow, because the GET method will lead to an oversized URL that the server can't handle. How the "follow" parameter can be passed in the body of the request?
UPD: here is what I've already tried using Insomnia (the URL is always 'https://stream.twitter.com/1.1/statuses/filter.json' and the method is always 'POST' and the server response is always "No filter parameters found. Expect at least one parameter: follow track locations"):
A plain text body with Content-Type: text/html
follow=2731236345
A json body with Content-Type: application/json
{
"follow": "2731236345"
}
Another json body
{
"follow": [
2731236345
]
}
However, when I use form-url-encoded with field "follow" and the value "2731236345" I receive the response "Unauthorized".
First of all, consider looking at the Twitter Developer Labs new endpoint, because this existing API will be retired, likely (but not yet confirmed) in 2020.
When you say "without any success", what libraries are you using, and at what levels of query parameters - you're not being very clear about what is not working here. 5000 user IDs is very large. Can you please be more specific about the errors you're seeing, and the code you're trying to run?
I've managed to connect using curl:
curl --request POST \
--url 'https://stream.twitter.com/1.1/statuses/filter.json' \
--header 'authorization: <censored>' \
--data 'follow=2731236345'
The same request doesn't work in Insomnia for some reason, but it doesn't matter for the goal of this post.
I am attempting to get an OAuth2 access token from ZOHO using RestSharp code. The Postman simulation works correctly so I know there is something I'm missing in my code.
I always get an "invalid client id" result status. However in Postman, it works and returns a code when I click the "Get new access token". I have the same items as in the Postman authorization tab (client_id, client_secret, etc). In Postman, "Body" is set to "none", and there are no parameters or headers. The only difference between my code and postman, is that Postman requires the Callback URL. My code is trying to get the code using "self-client", which bypasses the callback URL.
I have tried several different alternatives to the request call including ParameterType.Body, and ParameterType.GetOrPost. Is GetOrPost the same as a form?
client = New RestClient(ZOHO_API_URL)
request = New RestRequest(TokenUrl, Method.POST)
request.AddHeader("content-type", "application/x-www-form-urlencoded") ' also tried: "application/json")
request.AddParameter("grant_type", "authorization_code",
ParameterType.GetOrPost)
request.AddParameter("client_id", Client_ID, ParameterType.GetOrPost)
request.AddParameter("client_secret", Client_Secret,
ParameterType.GetOrPost)
request.AddParameter("code", Grant_Token, ParameterType.GetOrPost)
response = client.Execute(request)
This is the translated Postman code for RestSharp:
var client = new RestClient("http://");
var request = new RestRequest(Method.POST);
request.AddHeader("Postman-Token", "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx");
request.AddHeader("cache-control", "no-cache");
IRestResponse response = client.Execute(request);
Any ideas on what I am doing wrong. I have tried to view the raw data coming across with Fiddler, but when I do that, Postman indicates a failure.
What code do I need to use to duplicate what Postman is doing?
How do I implement a callback URL if that is also required?
I quickly checked ZoHo REST API docs and it seems like you should use the Limited Input Device authentication flow.
From what I can understand from their help page, you indeed need to do a POST request, but parameters must be specified as query parameters:
https://accounts.zoho.com/oauth/v3/device/code?
client_id=1000.GMB0YULZHJK411248S8I5GZ4CHUEX0&
scope=AaaServer.profile.READ&
grant_type=device_request
You will also get better off with JSON set as a default for serialisation and content type just by using client.UseJson().
It maybe that Postman is following a redirect from your API endpoint as the functionality is different Postman verses RestSharp (possibly missing a trailing slash or similar).
Try adding
client.FollowRedirects = false;
to your RestSharp code and analyse the result.
First steps of the Coinbase Oauth Authorization seem to work fine.
I request the customer code via the following URL:
"https://www.coinbase.com/oauth/authorize?response_type=code&client_id=XXXXXXXXXXXXXXXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&scope=user+balance"
I get back the code via URL..
Then trying to request the token with given CODE and CLIENT SECRET and CLIENT ID:
"https://api.coinbase.com/oauth/token&grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX"
With that I get an "404 Not found" Error..
Is there any obvious mistake in the URL.. or is it most likely an issue with the
Code or Secret etc. itself?
If Yes.. anything important to know there?
All that was followed from the description:
https://developers.coinbase.com/docs/wallet/authentication
Thank you so much for help!
The URL that you pasted:
https://api.coinbase.com/oauth/token&grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX
does not contain a query component since there's no ? character in there. You should rather use:
https://api.coinbase.com/oauth/token?grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX
and it looks like the documentation that you point to is the source of that error.
Moreover, the OAuth 2.0 spec says to use POST to the token endpoint, which is also stated in the docs but not clearly demonstrated in the sample. So you should send the parameters as form-encoded values an HTTP POST, e.g. the equivalent of the following cURL request:
curl -d "grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX" https://api.coinbase.com/oauth/token
Requesting it as a POST BODY did the job!
Although important changes:
- Redirect uri needs to be a proper external domain, uri for mobile apps will create a 401 Error..
-Encoding in ascii
import urllib
import urllib.request
import urllib.parse
data = urllib.parse.urlencode({'grant_type':'authorization_code', 'code': 'XXXXXX',
'redirect_uri': 'https://XXXXXX', 'client_id': 'XXXXXXXXXXX',
'client_secret' : 'XXXXXXXXXXX'})
binary_data = data.encode('ascii')
try:
response = urllib.request.urlopen('https://api.coinbase.com/oauth/token', data=binary_data)
print(response.status)
print(response.read())
except urllib.error.HTTPError as e:
print('%s %s' %(e.code, e.reason))
Got the rough structure from:
https://docs.python.org/3/library/urllib.request.html
Thanks a lot for the fast help!
I've a problem when trying to do a webrequest to UGC and authenticate using oAuth. I'm making a webrequest such as:-
WebRequest wr = WebRequest.Create("http://ugc.service/odata.svc/Ratings(Id=200)");
wr.Headers["authorization"] = "OAuth " + auth;
Where auth is my token returned from the access_token.svc. According to the documentation the token returned from the service should be something like:-
HufXeuUt%2FYYElA8SYjJOkUkrXxV9dyXRirmKhjW%2Fb%2FU%3D
However, what I'm being returned from access_token.svc is more like:-
{"access_token":"client_id%3dtestuser%26expiresOn%3d1361898714646%26digest%3d%2fW%2fvyhQneZHrm1aGhwOlgLtA9xGWd77hkxWbjmindtM%3d","expires_in":300}
I've parsed the JSON to extract various strings and attempted to pass these through to the authorization but whatever I try I get an error in the logs - "ERROR OAuth2AccessToken - Digest is wrong." Exactly what part of the token and in what format should I be passing through to authorization?
Many thanks
John
Like you mentioned, the protocol is this:
You make a post request to the access token end-point to get a token (you need to provide here your client_id and your client_secret as headers or as query parameters);
You get an answer similar to this: {"access_token":"sometoken","expires_in":300};
2.1 Worth knowing is that the token is url encoded and in UTF-8 format so, on Java side you need to do URLDecoder.decode("sometoken", "UTF-8"); while on .NET side you need to do HttpUtility.UrlDecode("sometoken", System.Text.Encoding.UTF8);;
Your next request needs to include the authorization header. On Java side you do builder.header("authorization", "OAuth " + decodedTokenString); while on .NET side you can use Client.Headers["authorization"] = "OAuth " + DecodedTokenString;
Worth mentioning is that the SharedSecret defined in the cd_webservice_conf.xml (/Configuration/AuthenticationServer/SharedSecret/) of the TokenAccessPoint needs to be the same as the SharedSecret defined in the cd_ambient_conf.xml (/Configuration/Security/SharedSecret/) of the (WebService)EndPoint.
Are you sure you decoded properly the token gotten from the server? Are you sure that you configured the proper SharedSecret in the two configuration files?
Hope this helps.