AWS Cognito Token with Authorization Code Grant PKCE returns {"error":"invalid_grant"}

user_137196 0
Viewed 6233

This request was working a couple of months ago but when we tried again and directly using curl. It now returns an invalid_grant. I been trying to search the documentation, but only see the following words without any exact reasons why?

invalid_grant

  • Refresh token has been revoked.
  • Authorization code has been consumed already or does not exist.

The client settings is as follows.

enter image description here

curl -X POST https://test-sso.auth.amazoncognito.com/oauth2/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code&client_id=xxxxxxx&redirect_uri=https%3A%2F%2F1c2d5a1xxxx.ngrok.io&code=SjkkDSSDs-b2A7nJPi3cmItyRZU4-b3GMjLls&code_verifier=sdXXXXXbUR2RmFIaTVQaVpTdndLOWoxOFU9Ig"

Has someone experienced this lately or has resolved this issue? I realized, even removing the PKCE. It's still returns invalid_grant.

Many thanks

amazon-cognito oauth-2.0 amazon-web-services
2 Answers

You don't need a client secret when using PKCE, which is explicitly designed for UI clients that can't keep one.

Your request and the overall behaviour both look entirely correct:

  • An Authorization Code can be used once only
  • If you try to use it again you get an invalid_grant error

Are you getting errors in real UIs or only with a cURL command? If it helps you can run my Sample UI and trace the HTTP messages, then compare to your own solution.

user_90198850

The documentation says that you can get invalid_grant when the authorization code has been consumed already or does not exist.

You might have sent an incorrect token request before, which then invalidated the authorization_code. Make sure to use a freshly generated authorization_code.

user_8288780
Related