Getting 401 Unauthorized {"error": "invalid_grant"} on POST to token endpoint

[toni....@bluecrossmn.com]

I feel like I'm missing something basic here. I found an older thread where someone was seeing 'unauthorized' when attempting to get a token, but the problem there was due to a mismatched redirect_uri, which is not the case here.

My curl command (replacing client secret with <client_secret>):

curl -X POST "https://sandbox.bluebutton.cms.gov/v1/o/token/" -u "Ta0SztVsxBa5HKP5JgkhnVdWrI8mafXfS1l1EdQS:<client_secret>” -d "code=heS4esuPZ8wmlOFUWBifIUVtswSm53&grant_type=authorization_code&redirect_uri=http://localhost:3000"

I get the same response whether I POST via curl, Postman, or through my app (axios):

401 Unauthorized

{

   "error": "invalid_grant"

}

The code is initially obtained using the same redirect_uri, which I verified is set correctly in the developer console.  This is the URL to get the code:

https://sandbox.bluebutton.cms.gov/v1/o/authorize/?redirect_uri=http://localhost:3000&response_type=code&client_id=Ta0SztVsxBa5HKP5JgkhnVdWrI8mafXfS1l1EdQS

[David Gage]

Hi,

Try including a "state" parameter in your initial authorization request.

Take care,

~David Gage

[toni....@bluecrossmn.com]

Aha! I didn't need to pass state, but I uncovered my 2-fold problem:

1) After an attempt to exchange a code for a token (even if it fails) the code becomes invalid. I had been attempting via my app before trying in Postman/curl, so every Postman/curl would fail no matter what.

2) Parameter order matters.  I had the order correct in Postman/curl (code, grant_type, redirect_uri), BUT I had a different order in my app (grant_type, redirect_uri, code), which was unfortunately being called first and invalidating the code. <smh>

[heerend...@gmail.com]

hi ,

I also face the same problem and i tried every thing but still same issue i am facing too.(Status: 401 Unauthorized, Error: {"error": "invalid_grant"} on POST Request to token endpoint).

and i also included a "state" parameter in my initial authorization request that's also not work.kindly help out me.

Thanks in advance

[Ma...@ekivemark.com]

Toni,

I don't know if this will help but I wrote a simple callback handler that would build curl statements.

https://github.com/ekivemark/bluebutton-callback-handler/blob/master/callback.py

This is a simple python app. available here:

https://github.com/ekivemark/bluebutton-callback-handler

Regards

- Mark

Blue Button 2.0 Team

[danusa....@gmail.com]

Hi Everyone! 

Did anybody figure out what was wrong in the POST request returning {"error": "invalid_grant"} ? 

I am having the same issue in my app and in the Postman also.

I already checked the parameters order and passed the state to the authorization endpoint.

Any thoughts ? 

TIA,

[Momin Shiraj]

Hi Try with Get Method.

I have hit your URL and get the respons below.

http://localhost:3000/?code=LZ9KGFwkdNeyNCN3WUj2G8haOYHYPB

[danusa....@gmail.com]

Hi!

The GET method is not allowed exchanging the code to token.

I have no more idea of what to do get the a token to access the demo patient data. 

Always returns {"error": "invalid_grant"}  using my applicatication and either the Postman.

Anyone else who can suggest anything else to try?

TIA,