kc6ba (kc6ba) asked a question.
I'm trying to do an exchange of an openID authorization code for a token, but I keep hitting this error.
When I hit the api to see how my app is configured, token_endpoint_auth_method is NOT none. It's client_secret_basic (which I am using)
"oauthClient": {
"autoKeyRotation": true,
"client_id": "****************",
"client_secret": "**************************",
"token_endpoint_auth_method": "client_secret_basic"
And the code to exchange the token:
response = requests.post(
TOKEN_URL,
headers={
"Accept": "application/json",
"Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
"authorization": "Basic {}".format(CLIENT_SECRET_BASIC)
},
data={
"grant_type": "authorization_code",
"redirect_uri": "http://localhost:9999/login",
"code": code,
},
)
Is this a bug with Okta? What am I doing wrong?
I eventually figured it out, Okta's v3 JavaScript Sign-In Widget was initiating a PKSE flow even when explicitly told not to. I downgraded to the v2.60 Sign-In Widget and it worked.