OAuth2: Discord API always responds with {"error": "invalid_grant"}

user_13763975 0
Viewed 3983

I am trying to implement Discord OAuth2 in my node.js Application. As soon as I try to get the access token from the given authorization code, I always get the HTTP response Error 400 {"error": "invalid_grant"}

let xhr = new XMLHttpRequest()
xhr.open('POST', 'https://discord.com/api/oauth2/token')

xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')

let payload ={
    client_id: clientID,
    client_secret: clientSecret,
    grant_type: 'authorization_code',
    code: code,
    redirect_uri: redirectUrl,
    scope: 'identify'
};

console.log(payload)
xhr.send(JSON.stringify(payload))

xhr.onreadystatechange = () => {
    console.log(xhr.status)
    console.log(xhr.responseText)
}

xhr.onerror = () => {
    console.log('Failed')
}
discord node.js oauth http javascript
4 Answers

Okay I solved the issue. For everyone who is experiencing the same issue that I had, I solved it by using axios and querystring to send the POST request to the Discord API (https://github.com/discord/discord-api-docs/issues/1131)

It seems that there is a problem with the JSON and the x-www-form-urlencoded format.

user_137639750

payload should not be a js object but a form data i.e

let payload = new FormData();
payload.append("key in string","value in string")
user_65283720

I had the same issue when trying to use on Next.js's GetServerSideProps function.

After searching a lot, I found an closed issue on Github solving this problem (Github Issue: Deep Linking with OAuth2 Not Working). Basically, we could not use JSON object on authentication request's body. We must use URLSearchParams object instead.

The payload should look like:

const payload = new URLSearchParams()

payload.append('client_id', process.env.DISCORD_CLIENT_ID)
payload.append('client_secret', process.env.DISCORD_CLIENT_SECRET)
payload.append('grant_type', 'authorization_code')
payload.append('redirect_uri', process.env.DISCORD_REDIRECT_URI)
payload.append('code', accessCode)
payload.append('scope', 'identify')
user_120580020

In my case, it was a very silly error. Instead of "response_type", I sent "response_type " (with a space); I randomly realized when I printed the HTML-formatted string and saw a %20 Make sure the parameters have the correct names!

user_55672230
Related