"errorCode":"INVALID_CREDENTIAL","httpCode":"403 Forbidden","message":"This credential is not valid"

[OvidiuMuresan]

Hi,

I'm working with laravel 5.2 and PHP 7, and after I generate my api_keys and api_secrete from https://eu.api.ovh.com/createApp/, when a try to implemente them in the code I've got from this repositorie, I get the same error message:

ClientException in RequestException.php line 111:
Client error: `GET https://api.ovh.com/1.0/me` resulted in a `403 Forbidden` response:
{"errorCode":"INVALID_CREDENTIAL","httpCode":"403 Forbidden","message":"This credential is not valid"}

My code:

$ovh_key = config('services.ovh.api_key');
$ovh_secret = config('services.ovh.api_secret');
$endpoint = 'ovh-eu';

if(is_null(session('consumer_key'))){
    $redirection = "redirect_url";
    $rights = array( (object) [
        'method'    => 'GET',
        'path'      => '/me*'
    ]); 

    // Get credentials
    $conn = new Api($ovh_key, $ovh_secret, $endpoint);
    $credentials = $conn->requestCredentials($rights, $redirection);
    //dd($credentials);
    // Save consumer key and redirect to authentication page
    session()->put('consumer_key',$credentials["consumerKey"]);
    header('location: '. $credentials["validationUrl"]);
}

$ovh = new Api( $ovh_key,  // Application Key 
        $ovh_secret,  // Application Secret
        $endpoint,      // Endpoint of API OVH Europe (List of available endpoints)
        session('consumer_key')); // Consumer Key 

dd($ovh->get('/me')) //try to access one of the console commands(https://api.ovh.com/console/) ;

Any idea why the error message? Thanks

[yadutaf]

This error typically indicates either:

• A consumer key that has not been validated
• A consumer key that has expired
• Invalid permissions

You may debug these situations by calling https://api.ovh.com/console/#/auth/currentCredential#GET from your PHP code.

[OvidiuMuresan]

I still have the same error message, if I get que api key and secret from https://eu.api.ovh.com/createApp/

but, if I get them from https://api.ovh.com/createToken/, everything works

What's the difference between the two uri to get the api key and secret?

[yadutaf]

• https://api.ovh.com/createToken/ generates the 3 keys at once for 1 account. This is the method to use to create scripts, single users
• https://eu.api.ovh.com/createApp/ generates the app key and app secret only. Customer token can be created on demand. This is the method to use if you need to access the account of other people. For white labeling for instance. The key must be validated by the customer by going on the page indicated by the redirecct url field returned by the API. The consumer key can NOT be used before. For obvious security reasons :)