I am trying to understand the 400 'Bad Request' error from the token request of the Authorization code flow tutorial. Others have asked before though I'm not interested in creating a headless/unattended app - I'd rather have users create their own authorizations when needed.
The response has an error of "invalid_client" and error_description of "The specified credentials were not valid."
Here is a sanitized copy of the message:
{Method: POST, RequestUri: 'https://oauth2.sky.blackbaud.com/token', Version: 1.1, Content: System.Net.Http.FormUrlEncodedContent, Headers:
{
Authorization: Basic ZTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxQ4
Content-Type: application/x-www-form-urlencoded
Content-Length: 212
}}
and the content, before encoded, contains the four required fields when using PKCE:
{[grant_type, authorization_code]}
{[code, 8fxxxxxxxxxxxxxxxxxxxxxxxxxxxxc0]}
{[redirect_uri, http://localhost/handler.ashx]}
{[code_verifier, tAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxpI]}
Questions:
- When passing the PKCE for authorization rest, it's SHA256 encrypted, Base 64 encoded string. Got it. For this token request, the value is called “code_verifier” and described in the tutorial as "high-entropy cryptographic random STRING using the unreserved characters ….. with a minimum length of 43 characters and a maximum length of 128 characters" -- does that mean it should NOT be encrypted or encoded, but the just the original randomly generated string? I get the 400 error either way, but thought it worth clarifying.
- How can I tell which part of the client is invalid? If the credentials were not valid, can I narrow the problem down to the authorization code in the header, or could the response error refer to other parts of the request, like encoding/etc?
- Has anyone successfully used ASP.NET 4.5-4.8 to create an httpclient request for the auth token, and could offer any advice on how to debug this error?
