Receiving Invalid client errors while trying to generate Access Token

Hi, I've been trying to generate an access token for my application.
I only need the publicly available information so I have been trying to use the "client_credentials" OAuth grant type but I keep getting errors and I can't figure out why.

For example if I run:

    curl --location 'https://api.ebay.com/identity/v1/oauth2/token' \
      --header 'Content-Type: application/x-www-form-urlencoded' \
      --header 'Authorization: Basic <BASE64(clientId:clientSecret)>' \
      --data-urlencode 'grant_type=client_credentials' \
      --data-urlencode 'scope=https%3A%2F%2Fapi.ebay.com%2Foauth%2Fapi_scope'

I get back the following response:

{
  "error":"invalid_scope",
  "error_description":"The requested scope is invalid, unknown, malformed, or exceeds the scope granted to the client"
}

I have also tried using some of the node client libraries that exist, such as "ebay-api" and "ebay-oauth-nodejs-client"

These each return

{
  "error": "invalid_client",
  "error_description": "client authentication failed"
}

I just don't know what I am supposed to do here.
I am using my production credentials, I have checked and double checked this, I don't know why I cannot access the API.

doosim-0

Posted 3 years ago·Last reply 3 years ago

8 comments

shipscript

·3 years ago

111 View listings

In your code example, the scope is already URL encoded, but is being URL encoded yet again.

   --data-urlencode 'scope=https%3A%2F%2Fapi.ebay.com%2Foauth%2Fapi_scope'

doosim-0

OP3 years ago

so if I try:

    curl --location 'https://api.ebay.com/identity/v1/oauth2/token' \
      --header 'Content-Type: application/x-www-form-urlencoded' \
      --header 'Authorization: Basic <BASE64(clientId:clientSecret)>' \
      --data-urlencode 'grant_type=client_credentials' \
      --data-urlencode 'scope=https://api.ebay.com/oauth/api_scope'

I get

{
  "error":"invalid_client",
  "error_description":"client authentication failed"
}

<span>https%3A%2F%2Fapi.ebay.com%2Foauth%2Fapi_scope</span>

I think is the url encoded version of

<span>https://api.ebay.com/oauth/api_scope</span>

And the developer documentation says that I am suypposed to url encode the scope before calling (https://developer.ebay.com/api-docs/static/oauth-client-credentials-grant.html)
Which is why I encoded it.
But trying it with the unencoded version does not work.

doosim-0

OP3 years ago

If I try using the example request from the dev docs: https://developer.ebay.com/api-docs/static/oauth-client-credentials-grant.html

<span>curl -X POST '</span><span>https://api.ebay.com/identity/v1/oauth2/token</span><span>' \<br/></span><span>  -H 'Content-Type: application/x-www-form-urlencoded' \<br/></span><span>  -H 'Authorization: Basic <BASE64(clientId:clientSecret)>' \<br/></span><span>  -d 'grant_type=client_credentials&scope=https%3A%2F%2Fapi.ebay.com%2Foauth%2Fapi_scope'</span>

I get:

{
  "error":"invalid_client",
  "error_description":"client authentication failed"
}

I do not know why it views me as an invalid client

shipscript

·3 years ago

111 View listings

Are you putting your own data into this header?

<span>  -H 'Authorization: Basic <BASE64(clientId:clientSecret)>' \</span>

This should be your ClientId (AppID) and ClientSecret (CertID) that are joined by a colon, and then that string must be base64 encoded.

doosim-0

OP3 years ago

Yes, this is what I have done, I did not want to put it on the forum for security reasons

shipscript

·3 years ago

111 View listings

Are you using your production credentials with the production endpoint?

I have posted a functional PHP version of the client-credential-based application-token creation that I use in my applications, with curl in longhand:

https://community.ebay.com/t5/Token-Messaging-Sandbox-related/Sample-PHP-for-generating-and-renewing-a-Shopping-token/td-p/33540297

Perhaps that longhand code will help you troubleshoot. Or, if you are using PHP, just grab the code and run with it.

doosim-0

OP3 years ago

I am definitely using my production credentials, it seems like ebay has decided I do not have access to the

<span>https://api.ebay.com/oauth/api_scope</span>

scope, but when I check the oauth scopes I am supposed to have access to, it is there