appwrite / appwrite/sdk-for-flutter

🐛 Bug Report: createOAuth2Token Invalid OAuth2 Response. Key and Secret not available

Open
#256 11 comments 6 reactions 0 assignees View on GitHub
bug
Dominant language
Dart
Stars
418
Forks
150
Avg merge
1h 23m
Merged PRs (30d)
3

Description

### 👟 Reproduction steps

_**Note: I already reported this error in the [Appwrite repo](https://github.com/appwrite/appwrite/issues/9977), but since it turned out to be a problem with the Flutter package, I'll recreate the issue here.**_
- - -
```
await account.createOAuth2Token(
provider: OAuthProvider.google,
success: 'appwrite-callback-[project-id]://[host]/v1/auth/oauth2/success/',
failure: 'appwrite-callback-[project-id]://[host]/v1/auth/oauth2/failure/',
);
```
Project id and host are set correctly - just anonymized here. Google OAuth is configured correctly in the backend.
Google oAuth is configured correctly, also because `createOAuth2Session `works. The user is also always created in the backend and also has the status “Verified email”

### 👍 Expected behavior

Automatic redirection back to the app even without succes and failure URL. Valid response so that the result can be processed further and the user can log in.

### 👎 Actual Behavior

If you trigger this and are redirected back to the app, the user is created in the backend, but i receive this error in Flutter: `Error: AppwriteException: , Invalid OAuth2 Response. Key and Secret not available. (500)` and in the Docker logs:
`Deprecated: json_decode(): Passing null to parameter #1 ($json) of type string is deprecated in /usr/src/code/app/controllers/api/account.php on line 1426`

If you leave success and failure url empty, you will not be redirected back to the app and you can see in the Docker logs:
```
Deprecated: json_decode(): Passing null to parameter #1 ($json) of type string is deprecated in /usr/src/code/app/controllers/api/account.php on line 1426
[Error] Timestamp: 2025-06-07T08:26:11+00:00
[Error] Method: GET
[Error] URL: /v1/account
[Error] Type: Appwrite\Extend\Exception
[Error] Message: User (role: guests) missing scope (account)
[Error] File: /usr/src/code/app/controllers/shared/api.php
[Error] Line: 375
```

### 🎲 Appwrite version

Different version (specify in environment)

### 💻 Operating system

Linux

### 🧱 Your Environment

Self-hosted,
Flutter 3.29.3,
Dart 3.7.2,
Appwrite 1.7.4

### 👀 Have you spent some time to check if this issue has been raised before?

- [x] I checked and didn't find similar issue

### 🏢 Have you read the Code of Conduct?

- [x] I have read the [Code of Conduct](https://github.com/appwrite/appwrite/blob/HEAD/CODE_OF_CONDUCT.md)

Contributor guide

Open the contributing guide

Research direction

Start at the Flutter SDK's createOAuth2Token entry point and compare its behavior with createOAuth2Session using the supplied Google OAuth reproduction. Inspect the related Appwrite account.php warning at line 1426 and trace the response handling. Done means the OAuth flow returns a usable response and redirects correctly with the documented success and failure URL cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
dart, flutter
Domain
api, authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.