search

hmrc / vat-api

Apache License 2.0
66 stars 17 forks source link

Invalid scope errors from prod OAuth2 service #1020

Closed JeeBeePee closed 1 month ago

JeeBeePee commented 1 month ago

I know we're not supposed to use this for production issues, but I emailed the SDS Team three hours ago and have had nothing back yet. I'll close it later today.

We get an invalid scope error when trying to get an auth token for read:vat and write:vat scopes. We've made no changes on our side; it just started happening this morning. We can get a token for each of those scopes individually, however we can't then call any endpoints with it.

This is affecting all users of the bridging software (including me!) so I was just wondering if any other MTD software providers are seeing the same thing? Or if anyone from the dev team has heard of the issue today.

JeeBeePee commented 1 month ago

Worked it out... we were URL encoding a + as a separator between the scopes. That has worked for 5 years, but no more. Changed to a space, working now. Will close this.

wapenshaw commented 1 month ago

This is affecting all users of the bridging software (including me!) so I was just wondering if any other MTD software providers are seeing the same thing? Or if anyone from the dev team has heard of the issue today.

@JeeBeePee We were facing the same issue since 4-5 days. Just removing the + from the scope fixed it. Thank you for posting this here saved us a lot of headache debugging

I was wondering if this breaking change was ever communicated officially? I checked all my emails but nothing about this and was wondering if there is some place else we need to monitor for changes like this. Even the releases section change logs dont mention this.