2

I'm working with a connected app which is using the JWT Bearer Token flow for API access. Generating access tokens and using them for API calls is working fine. When I use the Token Introspection to check the status of an access token I'm getting an "invalid client credentials" error.

request:{
  path:"",
  headers:{
    'Content-Type':"application/x-www-form-urlencoded",
    Accept:"application/json"
  },
  parameters:{
  },
  endpoint:"https://REDACTED_DOMAIN.lightning.force.com/services/oauth2/introspect",
  body:{
    token:"****",
    client_id:"****",
    client_secret:"****",
    token_type_hint:"access_token"
  }
},
service:null,
operation:null,
status:401,
reason:"Unauthorized",
body:{
  error:"invalid_client",
  error_description:"invalid client credentials"
},

According to the documentation I need to pass in a client_id and client_secret value for authorization. The documentation does not clearly state where these values are defined on the connected app.

  • For the client_id I'm using the "Consumer Key" listed on the connected App's "Manage" page. The example appears to be in the same format.
  • For the client_secret I'm using the "Consumer Secret" listed on the connected App's "Manage" page. The example does not appear to be in the same format however there is no value on the App's "Manage" page that matches the format in the example.

The connected app has the setting "Introspect All Tokens" enabled.

Anyone have any experience with this and can point me in the right direction?

5
  • You're on the right track. Please edit your question and provide full request/response trace (all HTTP headers + body) with redacted keys.
    – identigral
    Nov 6, 2019 at 22:17
  • Maybe has to do with the payload encoding. Make sure there are no invalid characters in those 2 values (client_id and client_secret) when you send the request. I've experienced this behavior when client_id has non URL safe characters. Nov 7, 2019 at 0:21
  • The "token" parameter does contain an exclamation point (!) however I'm passing it in the body of the POST request, not as a GET parameter. I updated the question to include more details on the request/response
    – Mark
    Nov 7, 2019 at 0:59
  • @Mark Deleting your comment and writing it up as the answer is recommended.
    – identigral
    Nov 18, 2019 at 23:46
  • Done and done..
    – Mark
    Nov 20, 2019 at 0:09

1 Answer 1

2

I was able to solve the issue. My parameters were correct however the endpoint is very strict about the ContentType. My application was using a JSON ContentType and payload which it did not recognize. After changing the ContentType to application/x-www-form-urlencoded it accepted the params and validated the token

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .