error Authorization code verifier invalid

[Hielko]

From one day to the next (around December 14) my app users can't get a token anymore, because of the following error when calling https://api.fitbit.com/oauth2/token:

{"errors":[{"errorType":"invalid_grant","message":"Authorization code verifier invalid: <auth_code> Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}

Nothing changed in the app (no update), I checked manually for the code verifier shown in this example error, the challenge used was <challenge>  and that's the correct challenge with the code verifier <verifier>

I get many reports starting around the December 14, 22:00 UTC (although the problem may exists already a few hours, not every user reports a problem).

I have no idea what is wrong, because it worked for a long time. Did something change at the Fitbit checking mechanism for code challenge/code verifier?

[Gordon-C]

Hi @Hielko 

Please don't provide sensitive data in the public forums, such as your challenge and verifier.   We made a change recently where the applications using PKCE need to specify the application type = "client".   Would you please verify what your application type is?

GOrdon

[Hielko]

Hi @Gordon-C, 

Thanks for your reply. I'm sorry for the sensitive data. 

The OAuth 2.0 application type is 'client', I'm sure it already was since the beginning.

Please let me know what additional information you need. I am collecting complaints from users currently 😞 

Best regards,

Hielko

[Gordon-C · Accepted solution]

After further investigation, it was determined there was a typo in the authorization URL's code_challenge_method parameter name which defaulted the code_challenge_method value to "plain" instead of user specified "S256".

[MuskanMohammad]

Hey Gordon ,
This is my code but why am I getting the error 
400 Bad Request: "{"errors":[{"errorType":"invalid_grant","message":"Authorization code verifier invalid: <code> Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}"

public ResponseEntity<?> exchangeCodeForToken(@RequestBody String body) {

final String CLIENT_ID = <CLIENT_ID>;

final String CLIENT_SECRET = <CLIENT_SECRET>;

final String REDIRECT_URI = <REDIRECT_URI>;

try {

HashMap param = new Gson().fromJson(body, HashMap.class);

String code = (String) param.get("authorizationCode");

String codeVerifier = generateCodeVerifier();

// Encode client_id:client_secret using Base64

String credentials = CLIENT_ID + ":" + CLIENT_SECRET;

String encodedCredentials = Base64.getEncoder().encodeToString(credentials.getBytes("UTF-8"));

// Prepare the request headers

HttpHeaders headers = new HttpHeaders();

headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

headers.set("Authorization", "Basic " + encodedCredentials);

// Prepare the request body (URL-encoded format)

String requestBody = "code=" + code +

"&grant_type=authorization_code" +

"&code_verifier=" + codeVerifier +

"&client_id=" + CLIENT_ID +

"&redirect_uri=" + REDIRECT_URI;

HttpEntity<String> requestEntity = new HttpEntity<>(requestBody, headers);

RestTemplate restTemplate = new RestTemplate();

// Exchange the code for a token

ResponseEntity<String> response = restTemplate.exchange(TOKEN_URL, HttpMethod.POST, requestEntity, String.class);

return ResponseEntity.ok(response.getBody());

} catch (UnsupportedEncodingException e) {

e.printStackTrace();

return ResponseEntity.status(500).body("Error generating authorization URL: " + e.getMessage());

}

}

Can anyone plz lemme know how to solve it

[Gordon-C]

Hi @MuskanMohammad 

First, I would comment out your code that uses the code verifier and code challenge.  This will make certain your authorization flow works without using PKCE.   

If this works, then the problem is likely the code verifier and code challenge don't match.   Some people use your OAuth 2.0 Tutorial to verify the method they use to generate the code challenge from the code verifier is correct.  You should be able to enter your code verifier value into the PKCE Code Verifier field to see what the correct code challenge value would be.