Why am I receiving a 400 response of `invalid_request`:`no client authentication mechanism provided`?

user_687672 0
Viewed 568

I'm in the process of attempting to verify a JWT access_token against OneLogin's api as described here. My code is as follows:

const client_id = MY_CLIENT_ID
const client_secret = MY_CLIENT_SECRET
const token = MY_ONE_LOGIN_JWT_ACCESS_TOKEN

axios
  .post(
    "https://my-endpoint-dev.onelogin.com/oidc/2/token/introspection",
    { token, client_id, client_secret, token_type_hint: "access_token" },
    {
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
    }
  )
  .then((response) => {
    console.log("response");
    console.log(response);
  })
  .catch((err) => {
    console.log("err");
    console.log(err);
  });

The endpoint appears to work fine, in fact when the JWT has become expired it gives me an error stating as such and I need to update the token I'm passing along. However, whenever I make a standard request as shown above with valid credentials and tokens I get the following error response:

{error: "invalid_request", error_description: "no client authentication mechanism provided"}

There's no documentation on the provided page that describes what is wrong with the request when that error is received. From the documentation, so far as I can tell, my request is formatted correctly.

I have verified that the Token Endpoint in OneLogin is set to POST, so my assumption that the client_secret should be in the body is documented as correct (though I did try it as Basic just to verify):

OneLogin Configuration

I've attempted searching for a solution, but the only thing close I've found advises that the Content-Type header may not be supplied. I've made sure to add that to the list of headers and have verified it shows up in the request, but still the error persists.

Any thoughts to what I may be missing here?

EDIT:

Attempted to do a cURL request and received a 200 response back with the same information. Leading me to believe it's something with the axios call that I have incorrect.

onelogin jwt openid-connect request javascript
2 Answers

I get this message when I don't provide either the client_id or the client_secret. Hopefully you can validate that you are actually sending both in your request. Maybe you can try the request via postman to double check.

user_34718170

I ran into the same issue and finally figured out you have to turn the data into a query string: https://axios-http.com/docs/urlencoded

For example:

import qs from 'qs';
const data = { 'bar': 123 };
const options = {
  method: 'POST',
  headers: { 'content-type': 'application/x-www-form-urlencoded' },
  data: qs.stringify(data),
  url,
};
axios(options);

user_15642680
Related