Exchange code for token flow: 401 Unauthorized "invalid_grant"
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 254
- Forks
- 53
- PR merge metrics
- No merged PRs in 30d
Description
Title: Exchange code for token flow: 401 Unauthorized "invalid_grant"
Issue found of:
Endpoint(s):
POST /oauth2/token
Scope(s):
- Code retrieved from Connect Flow
Steps to reproduce:
Sporadic, but affects certain users with us repeatedly. Is there any reason a certain user would be unable to use our login flow repeatedly?
Most recent example for us is userId 91742971 - this failure happens on all login attempts with us.
Expected behaviour:
AccessToken provided as per normal response for 99% of users logging in
Actual behaviour:
401
{"error": "invalid_grant"}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with POST /oauth2/token and the Connect Flow code exchange described in the report. Reproduce the 401 invalid_grant for userId 91742971 if access is available, compare it with successful login attempts, and identify the condition causing the repeated failure; done means the cause is established and the error or exchange behavior is addressed.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100