Google OAuth “error”: “invalid_grant” response to request to exchange one time auth code for refresh...
I am trying to implement Google Signin for our server-side app using this documentation:
Google Sign-In for server-side apps
I successfully followed steps 1-6 and were able to obtain the one time auth code. However on step 7 when I make a request to exchange the one time auth code for access token I get a response:
{
"error": "invalid_grant",
"error_description": "Bad Request"
}
I tried both manual HTTP POST request using CURL and also tried the official api client Python library. The response is always the same "invalid_grant".
When requesting the one time auth code I made sure to request offline access mode.
I verified that the user for whom I obtain the one time auth code indeed has granted access by going to https://myaccount.google.com/u/0/permissions and ensuring that our app is listed in the "Third-party apps with account access" with correct access scopes.
Can you please advise on how to debug this? The error message is unfortunately not helpful and I already tried everything I could find about this particular error on Stack overflow or elsewhere.
UPDATE: I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt.
Hope this is help for for others that will be working on this.
I with OAuth requests return more informative error messages to help with debugging.
oauth-2.0 google-oauth google-signin google-oauth2
asked Nov 16 '18 at 1:44
TigranTigran
213
add a comment |
I am trying to implement Google Signin for our server-side app using this documentation:
Google Sign-In for server-side apps
I successfully followed steps 1-6 and were able to obtain the one time auth code. However on step 7 when I make a request to exchange the one time auth code for access token I get a response:
{
"error": "invalid_grant",
"error_description": "Bad Request"
}
I tried both manual HTTP POST request using CURL and also tried the official api client Python library. The response is always the same "invalid_grant".
When requesting the one time auth code I made sure to request offline access mode.
I verified that the user for whom I obtain the one time auth code indeed has granted access by going to https://myaccount.google.com/u/0/permissions and ensuring that our app is listed in the "Third-party apps with account access" with correct access scopes.
Can you please advise on how to debug this? The error message is unfortunately not helpful and I already tried everything I could find about this particular error on Stack overflow or elsewhere.
UPDATE: I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt.
Hope this is help for for others that will be working on this.
I with OAuth requests return more informative error messages to help with debugging.
oauth-2.0 google-oauth google-signin google-oauth2
asked Nov 16 '18 at 1:44
TigranTigran
213
Please edit your question and include the code you have tried. Both curl and python is fine.
– DaImTo
Nov 16 '18 at 8:29
@DaImTo thanks for replying, I resolved my issue, see the update.
– Tigran
Nov 16 '18 at 16:38
Please post your update as an answer. Your problem and solution will help others.
– John Hanley
Nov 16 '18 at 18:11
add a comment |
I am trying to implement Google Signin for our server-side app using this documentation:
Google Sign-In for server-side apps
I successfully followed steps 1-6 and were able to obtain the one time auth code. However on step 7 when I make a request to exchange the one time auth code for access token I get a response:
{
"error": "invalid_grant",
"error_description": "Bad Request"
}
I tried both manual HTTP POST request using CURL and also tried the official api client Python library. The response is always the same "invalid_grant".
When requesting the one time auth code I made sure to request offline access mode.
I verified that the user for whom I obtain the one time auth code indeed has granted access by going to https://myaccount.google.com/u/0/permissions and ensuring that our app is listed in the "Third-party apps with account access" with correct access scopes.
Can you please advise on how to debug this? The error message is unfortunately not helpful and I already tried everything I could find about this particular error on Stack overflow or elsewhere.
UPDATE: I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt.
Hope this is help for for others that will be working on this.
I with OAuth requests return more informative error messages to help with debugging.
oauth-2.0 google-oauth google-signin google-oauth2
asked Nov 16 '18 at 1:44
TigranTigran
213
I am trying to implement Google Signin for our server-side app using this documentation:
Google Sign-In for server-side apps
I successfully followed steps 1-6 and were able to obtain the one time auth code. However on step 7 when I make a request to exchange the one time auth code for access token I get a response:
{
"error": "invalid_grant",
"error_description": "Bad Request"
}
I tried both manual HTTP POST request using CURL and also tried the official api client Python library. The response is always the same "invalid_grant".
When requesting the one time auth code I made sure to request offline access mode.
I verified that the user for whom I obtain the one time auth code indeed has granted access by going to https://myaccount.google.com/u/0/permissions and ensuring that our app is listed in the "Third-party apps with account access" with correct access scopes.
Can you please advise on how to debug this? The error message is unfortunately not helpful and I already tried everything I could find about this particular error on Stack overflow or elsewhere.
UPDATE: I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt.
Hope this is help for for others that will be working on this.
I with OAuth requests return more informative error messages to help with debugging.
oauth-2.0 google-oauth google-signin google-oauth2
oauth-2.0 google-oauth google-signin google-oauth2
asked Nov 16 '18 at 1:44
TigranTigran
213
asked Nov 16 '18 at 1:44
TigranTigran
213
edited Nov 16 '18 at 16:37
Tigran
asked Nov 16 '18 at 1:44
TigranTigran
213
asked Nov 16 '18 at 1:44
TigranTigran
213
asked Nov 16 '18 at 1:44
TigranTigran
213
213
Please edit your question and include the code you have tried. Both curl and python is fine.
– DaImTo
Nov 16 '18 at 8:29
@DaImTo thanks for replying, I resolved my issue, see the update.
– Tigran
Nov 16 '18 at 16:38
Please post your update as an answer. Your problem and solution will help others.
– John Hanley
Nov 16 '18 at 18:11
add a comment |
Please edit your question and include the code you have tried. Both curl and python is fine.
– DaImTo
Nov 16 '18 at 8:29
@DaImTo thanks for replying, I resolved my issue, see the update.
– Tigran
Nov 16 '18 at 16:38
Please post your update as an answer. Your problem and solution will help others.
– John Hanley
Nov 16 '18 at 18:11
Please edit your question and include the code you have tried. Both curl and python is fine.
– DaImTo
Nov 16 '18 at 8:29
Please edit your question and include the code you have tried. Both curl and python is fine.
– DaImTo
Nov 16 '18 at 8:29
@DaImTo thanks for replying, I resolved my issue, see the update.
– Tigran
Nov 16 '18 at 16:38
@DaImTo thanks for replying, I resolved my issue, see the update.
– Tigran
Nov 16 '18 at 16:38
Please post your update as an answer. Your problem and solution will help others.
– John Hanley
Nov 16 '18 at 18:11
Please post your update as an answer. Your problem and solution will help others.
– John Hanley
Nov 16 '18 at 18:11
add a comment |
1 Answer
1
active
oldest
votes
I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is helpful for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.
answered Nov 18 '18 at 0:58
TigranTigran
213
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53330298%2fgoogle-oauth-error-invalid-grant-response-to-request-to-exchange-one-time-a%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is helpful for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.
answered Nov 18 '18 at 0:58
TigranTigran
213
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
add a comment |
I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is helpful for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.
answered Nov 18 '18 at 0:58
TigranTigran
213
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
add a comment |
I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is helpful for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.
answered Nov 18 '18 at 0:58
TigranTigran
213
I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is helpful for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.
answered Nov 18 '18 at 0:58
TigranTigran
213
edited Nov 19 '18 at 15:47
answered Nov 18 '18 at 0:58
TigranTigran
213
answered Nov 18 '18 at 0:58
TigranTigran
213
answered Nov 18 '18 at 0:58
TigranTigran
213
213
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
add a comment |
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
I just ran into this exact problem this weekend. Your answer instantly came to mind.
– John Hanley
Nov 19 '18 at 8:21
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53330298%2fgoogle-oauth-error-invalid-grant-response-to-request-to-exchange-one-time-a%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Please edit your question and include the code you have tried. Both curl and python is fine.
– DaImTo
Nov 16 '18 at 8:29
@DaImTo thanks for replying, I resolved my issue, see the update.
– Tigran
Nov 16 '18 at 16:38
Please post your update as an answer. Your problem and solution will help others.
– John Hanley
Nov 16 '18 at 18:11