amzn / selling-partner-api-models

This repository contains OpenAPI models for developers to use when developing software to call Selling Partner APIs.
Apache License 2.0
580 stars 730 forks source link

AuthorizationApi.getAuthorizationCode returning 400 bad request #798

Closed gasper-vrhovsek closed 2 years ago

gasper-vrhovsek commented 3 years ago

Hi. I am developing a java application as a POC for using this API by a customer.

I have built the JAVA library as described in Generating a Java SDK with LWA token exchange and authentication, added them as maven dependencies in my pom.xml and build the app.

I have successfully called the GetMarketplaceParticipations method in the SellersApi and got relevant results. The problem starts when trying to authenticate other sellers through the AuthorizationApi.getAuthorizationCodeAsync. We have customers who have already authorised us through the MWS api and we can't authorize them through the Selleing-partner-api. The API always returns:

{
  "errors": [
    {
      "code": "InvalidInput",
      "message": "Developer ID 35XXXXXXXXXX is not associated with the application id.",
      "details": ""
    }
  ]
}

Me and some guys from the rest of the team have double and triple checked, this developer id is entered for the correct region in sellercentral.amazon.com > Apps & Service > Develop Apps.

I am calling this as a grantless operation, without the refresh token and with the "sellingpartnerapi::migration" scope. Are we perhaps forgetting any policies for this? I only added roles and policies from the Selling Partner API Developer Guide

Could the missing Oauth URI's in our app configuration in seller central the culprit for this error?

I am not sure, if this is the correct github repo for this report, but hopefully i can get some suggestions on how to deal with this issue and what we are perhaps doing wrong.

kozlek commented 3 years ago

Hi, I'm currently facing the same issues as @gasper-vrhovsek. My app is in draft mode, I'm able to fetch my own data using the self-authorization mode. Then if I try to use the getAuthorizationCode endpoint to use my old grants from MWS, and I'm getting the same error message. I checked the Developer ID, it is correct both in my Developer Profile and in the app settings.

gasper-vrhovsek commented 3 years ago

@kozlek we had issues authorizing new sellers with the LWA flow until our application was in draft. We had to edit the app to enter both Oauth url settings and get that approved and published. After that we could get sellers authorized using this PHP project.

Perhaps it's the same issue you're facing. As far as i could figure it out in the past couple of weeks, draft applications only support self-authorization. If this assumption is wrong, please someone correct me.

kozlek commented 3 years ago

@gasper-vrhovsek we also configured OAuth urls, and then we published our application. After 2 days, we stopped receiving the 400 error. Instead we have a new one: 500 INTERNAL ERROR: "We encountered an internal error. Please try again."

We get that since 1 week. We are discussing with the support, but we didn't find any solutions for now. We also get that 500 error using Postman with AWS Signature authentication, which make us think this is effectively server side related and not to our client implementation.

jlevers commented 3 years ago

@parvathm could you please confirm if it is mandatory to have your app published in order to make requests to getAuthorizationCode? If so, I don't think that makes a lot of sense, because it's possible to leave an application in draft state while still having other sellers authorize it, assuming you implement the website-based authorization flow.

LukeLim81 commented 3 years ago

I am getting the exact same problem. My status has been in Published. "Current edit is pending approval" for over 10 days.

Self authorization's refresh token is working, but not when I tried to getAuthorizationCode

github-actions[bot] commented 2 years ago

This is a very old issue that is probably not getting as much attention as it deserves. We encourage you to check if this is still an issue after the latest release and if you find that this is still a problem, please feel free to open a new issue and make a reference to this one.