Feedback
Question

ErrTokenInvalid during access token exchange request

  • 15 November 2021
  • 4 replies
  • 71 views

I am sadly struggling to get past the initial steps of Oauth2 and cannot find any documentation about this error.

  1. Authenticating using my personal token works like a charm
  2. Getting an application’s temporary token works fine 
  3. Getting an application’s refresh token fails

     

Here are the steps followed:

  1. call https://api.typeform.com/oauth/authorize?state=xyz789&client_id=********&redirect_uri=********&scope=offline+forms:read manually in a browser
  2. grant access by clicking “Accept”, 

     

  3. Copy the code from the URL following the redirection

  4. Request a token using the code from step 3 but fails:

 

If I repeat the same steps above and remove the offline scope it works fine.

What am I doing wrong … ?


4 replies

Userlevel 7
Badge +5

Hi @davidb huh, that’s interesting. Just to make sure I’m reading this right, if you remove the offline scope, you are able to receive a refresh token?

@mathio do you happen to know anything about this? 

Userlevel 6
Badge +5

Sorry I dont have much experience with OAuth, but maybe @picsoung might.

Hi @davidb huh, that’s interesting. Just to make sure I’m reading this right, if you remove the offline scope, you are able to receive a refresh token?

@mathio do you happen to know anything about this? 

Hi @Liz thank you for your reply.

Removing the offline scope works absolutely fine in giving me a temporary code (as expected), but I am trying to automate my connection to the API and therefore need a refresh token approach.

My understanding from the documentation is that you have to:

  1. initially grant the application access manually through the browser using the offline scope
  2. hit https://api.typeform.com/oauth/token (grant_type=authorization_code) to get a refresh_token once
  3. subsequently hit https://api.typeform.com/oauth/token again (grant_type=refresh_token) from my scripts every time I need a new token (and therefore remove the manual operations)

If my understanding is correct, then only step 1 is working, step 2 fails with error code ErrTokenInvalid  which is not documented.

Thanks for your help

David

Userlevel 7
Badge +5

Hi @davidb I asked our tech support team about this, and they mentioned that you shouldn’t need to use the offline scope to get this to work. Is there any particular reason you’re hoping to use this scope? 

Reply