3

I'm adding the ability to post todos to my Todist list via a simple app. At the moment I am getting the response "error"=>"invalid_grant" when exchanging my code for an access_token.

I'm unsure exactly what 'invalid_grant' is referring too in this context. Other answers I find seem to be regarding various Google APIs. The Todoist API documentation makes no mention of it.

The post request for token exchange is:

uri = URI('https://todoist.com/oauth/access_token')
result = Net::HTTP.post_form(uri, client_id: ENV['TODOIST_CLIENT_ID'], client_secret: ENV['TODOIST_CLIENT_SECRET'], code: params[:code])
json_body = JSON.parse(result.body) # <- prints error

Any help understanding and solving this is much appreciated.

Update

After reading Takahiko Kawasaki's answer, I have updated the request to the following, but have the same error message.

uri = URI('https://todoist.com/oauth/access_token')
data = {
  :client_id => ENV['TODOIST_CLIENT_ID'],
  :client_secret => ENV['TODOIST_CLIENT_SECRET'],
  :code => params[:code],
  :grant_type => 'authorization_code',
}
result = Net::HTTP.post_form(uri, data)
json_body = JSON.parse(result.body)
Vadim Kotov
  • 8,084
  • 8
  • 48
  • 62
tonyedwardspz
  • 1,707
  • 2
  • 22
  • 45

2 Answers2

1

Add the following.

grant_type: 'authorization_code'

See RFC 6749, 4.1.3. Access Token Request for details.

Additional comment for the revised question.

It seems that the OAuth implementation by Todoist is not mature. I took a look at their API document and soon found some violations against RFC 6749.

For example, (1) scopes must be delimited by spaces but their document says commas should be used. (2) Their token endpoint does not require the grant_type request parameter, which is required by the specification. (3) The value of the error parameter in the response from a token endpoint should be invalid_grant when the presented authorization code is wrong, but their API document says the value will be bad_authorization_code, which is not an official value.

In addition, this is not a violation, but the specification of their API to revoke access tokens implies that they don't know the existence of the official specification for access token revocation, RFC 7009.

For public clients (RFC 6749, 2.1. Client Types), e.g. smartphone applications, the client_secret request parameter of a token endpoint should be optional, but their API document says it is required.

Because their OAuth implementation does not comply with the specification, it would be better for you to ask Todoist directly.

Community
  • 1
  • 1
Takahiko Kawasaki
  • 18,118
  • 9
  • 62
  • 105
  • Thanks for the link, it makes more sense. Where do I add the `grant_type`? It seems to not work as either a header of query param? – tonyedwardspz May 11 '16 at 12:49
  • For example, after `code: param[:code]` like `Net::HTTP.post_form(..., code: params[:code], grant_type: 'authorization_code')`. – Takahiko Kawasaki May 11 '16 at 12:52
  • @tonyedwardspz Updated my answer. – Takahiko Kawasaki May 11 '16 at 14:49
  • Thanks for the follow up. After reading a bit more about Oauth in general I decided it was best to email them anyway. I'll update with an answer when I hear back. Thanks again for your time, I understand this a lot more now :) – tonyedwardspz May 11 '16 at 15:33
  • 1
    Also, double check to be sure that your `client_id` and `client_secret` are correct. I had miscopied one and was getting the `invalid_grant` error. – charltoons Jun 14 '19 at 21:16
1

The latest version of the Todoist API (v8) does not require the grant_type parameter so this is not currently the issue.

Two possible reasons for receiving the invalid_grant error are:

  1. The code was not used within a certain length of time and has expired
  2. The code has already been used to generate an access token and so is no longer valid

In both cases, generating a new code before making the POST request should sort the problem.

Richard Williams
  • 2,044
  • 1
  • 24
  • 28
  • everytime someones tries to login, I am generating a code (which is getting generated successfully for my client_id). But, after using this code for [this token-exchange-api](https://developer.todoist.com/guides/#step-3-token-exchange), i am getting this error `invalid_grant`. – Manish Aug 03 '23 at 17:28