Error in exchanging code for access token: invalid grant / The code or secret is not valid

[shawnlauzon]

Hi all, I'm having a problem exchanging the auth code for access token. This was working previously. Not sure when it started failing because we've been using the refresh token in the app.

Steps to reproduce:

1. Open hivesigner UI with https://hivesigner.com/oauth2/authorize?client_id=leofinance&redirect_uri=https%3A%2F%2Falpha.leofinance.io%2Fmobile%2Fcallback&response_type=code&scope=vote,comment,comment_options,offline,custom_json,claim_reward_balance
2. User enters correct username and password
3. My server receives code in URL
4. Call to exchange code for token:

   curl -H "Content-Type: application/json" \
   -d '{ "code": "eyJz...dfQ..", "client_secret": <as registered> }' \
   https://hivesigner.com/api/oauth2/token

Implicit grant flow works well, but we need offline access.

[feruzm]

@shawnlauzon Could you check if you have correct client_secret? I remember last time someone from your team have changed it, maybe same thing happened again.

[shawnlauzon]

Yes, that's the first thing I verified. It did not change.

On Mon, Oct 25, 2021 at 4:45 PM Feruz M @.***> wrote:

@shawnlauzon https://github.com/shawnlauzon Could you check if you have correct client_secret? I remember last time someone from your team have changed it, maybe same thing happened again.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ecency/hivesigner-sdk/issues/13#issuecomment-951059434, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAEVJSKY3Y4UTPKVDOZ3LK3UIV3SFANCNFSM5GVTBVEQ .

[shawnlauzon]

Just to make completely sure, we regenerated a new client secret and set it again. And this time it worked!

I wonder if there is an issue with the UI that sets the client secret. We had made a change to the redirect URIs and it said to leave the field blank to not change the client secret. But I wonder if it reset it somehow.

But everything works on my side now, so I'm closing the ticket. Thank you!