Oauth2 401 Error

[quinlayen]

Aloha, I have seen this same error posted in past posts, however none of the responses are working for me.  I am using Axios inside of a React app.

I have successfully returned the auth_code, however when I make my post for the token I receive the following error:

1. {errors: [{errorType: "invalid_client",…}], success: false}
1. errors: [{errorType: "invalid_client",…}]
1. 0: {errorType: "invalid_client",…}
1. errorType: "invalid_client"
2. message: "Invalid authorization header format. The header was not recognized to be a valid header for any of known implementations or a client_id was not specified in case of a public client Received header = null. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
2. success: false

Below is my POST:

const response = await axios.post("https://api.fitbit.com/oauth2/token", {

body: form_data,

headers

});

And here is my console logs of the form_data and headers:

headers:

1. Content-Type: "application/x-www-form-urlencoded"
2. Authorization: "Basic [(here I am using a Base64 client_id:client_secret)]". 

form_data:client_id=[Redacted]&grant_type=authorization_code&redirect_uri=http%253A%252F%252Flocalhost%253A3000%252Fauth%252Fcallback&code=784544a4e1d789bc1a1f6692692795b74e8c28e6

I have confirmed my client id and secret numerous times.  

Can you see where I am making a mistake?

[GordonFitbit]

Aloha @quinlayen 

At a high-level, it looks like you have everything included correctly.   However, I'm not familiar with your programming environment to know of its quirks.  A few questions I have are

1. Was there any other messaging provided besides "invalid_client"?   There are several reasons for receiving the errorType "invalid_client",https://dev.fitbit.com/build/reference/web-api/troubleshooting-guide/error-messages/#401-unauthorize....  Having the corresponding message might help.
2. I'm not familiar with the form_data:<headers> to know if this is correct behavior or syntax.
3. Have you tested the process within the OAuth2 Tutorial to confirm you have everything configured correctly?  Here's the documentation on where to find it, https://dev.fitbit.com/build/reference/web-api/troubleshooting-guide/debugging-tools/#oauth-2-0-tuto....

Gordon

[quinlayen]

Hi Gordon,  thanks for replying.

Here are the answers to your questions:

1) yes there was more in the error.  I pasted the entire error in the OP, which included the message which indicates it is an unauthorized header format.

2)Regarding the form_data, I guess I should have posted what it looked like in code so that it made more sense.  I created an object named form_data and made that the body of the POST. I then console logged it and that log is what I put in the OP.  Here is what the code looks like with a few changes to allow me to post here without giving private info:

const form_data = qs.stringify({

    client_id,

    grant_type,

    redirect_uri,

    code,

});

let headers = {

    'Content-Type': 'application/x-www-form-urlencoded',

    Authorization: 'Basic client_id:client_secret'.   //the client_id:client_secret is Base64

    )}`

};

const response = await axios.post("https://api.fitbit.com/oauth2/token", {

    body: form_data,

    headers

});

3. I have run this same code using a Node server I wrote and it worked fine

[GordonFitbit]

Hi @quinlayen 

I feel like something is not translating correctly with your code.   I've been searching around for examples that might help and haven't found anything yet.   Would you please provide me with your client ID.   Maybe I can figure out what's going on in our logs.

Thanks!

Gordon

[GordonFitbit]

Also, instead of using stringify, have you tried listing out all of the parameters and their values to see if it works.   For example,

body: "client_id=<value>&grant_type=authorization_code&..."

[quinlayen]

Hi @GordonFitbit .  I actually figured it out.  I was urlencoding the redirect_uri as I thought I was supposed to, however that did not work in translation.  Not sure why, but when I used just the url as is without encoding I was able to get it to work.

Thank you for taking the time to work this out for me.