Login with Facebook using SoundCloud web api is returning a 401 error

[bricemacias]

Title: login with Facebook using SoundCloud web api is returning a 401 error

Issue found of: July 12th, 2022

Endpoint(s):

• GET https://api.soundcloud.com/oauth2/token

Steps to reproduce:

• We use the authentication flow using this endpoint : https://secure.soundcloud.com/connect?response_type=code&redirect_uri=[redirect_uri]&client_id=[client_id]

• If we use SoundCloud directly, entering mail and password, everything will work fine. We get the code and we use it in : https://api.soundcloud.com/oauth2/token with payload { client_id=[my_client_id], client_secret=[my_client_secret], grant_type=authorization_code, redirect_uri=[my_redirect_url], code=[code_returned_in_auth_response_url] }, and it will work.

• If we use the Facebook login however, https://api.soundcloud.com/oauth2/token will return a 401 error

It is exactly the same issue as reported here some time ago : https://stackoverflow.com/questions/20327184/connect-to-soundcloud-api-with-facebook-account

Expected behaviour:

SoundCloud login should work with code received from url after user logs in through Facebook, as it works with normal email and password. We have the same problem with login with Google too.

Actual behaviour:

401 unauthorised error

[dpreussler]

@bricemacias we had login issues earlier today platform wide, can you confirm the problem still occurs?

[bricemacias]

Hi @dpreussler, thank you for your answer, yes I just tried with normal email and password authentication and it works fine, but when I try using Facebook login I get Request failed with status code 401

Can you confirm it's supposed to be the same implementation, meaning getting the code from the first url response after user logs in and passing it to https://api.soundcloud.com/oauth2/token with the same payload as normal email and password login ? Or should there be a special implementation on our side that we should follow for Facebook or Google (and Apple but we didn't test it yet) ?

[mgoodfellow]

Sounds like you are capturing the callback from Facebook to SoundCloud and trying to use that code.

The only code you should capture is when SoundCloud calls back to your defined redirect_uri and appends the code as a query parameter there. It sounds to me like you are watching the URL and capturing a code parameter on the URL change (you refer to "first url response") - if this is the case then you are probably capturing the wrong callback which wasn't meant for you. This isn't the correct implementation, and would not be considered best practice.

Can you confirm it's supposed to be the same implementation, meaning getting the code from the first url response after user logs in

The correct implementation is extracting the code parameter when SoundCloud returns control to your application via the redirect_uri.

The form will be:

[redirect_uri]?code=XXXX&state=AnyStateYouSentButThatIsOptional

It is documented here:

https://developers.soundcloud.com/docs/api/guide#authentication

[bricemacias]

Yes indeed ! I was recovering the code from the first response URL and not from the one that had the redirect url in it, thank you so much !

Thanks a lot for your fast responses too :)