Good afternoon, everyone! Guys I'm going through a problem with basic authentication in Postman, I'll leave below details of what's going on. I need to send a Post so I can perform authentication and the server will return me a token bearer, but I'm taking a 400 error. I'll leave attached images of the Curl request and how I'm setting up in Postman.
Auth:
enter image description here
Body:
enter image description here
Reading the documentation I'm using I realized that I needed to perform a basic authentication using client_id and client_secret for me to be returned a token bearer, the same error is returned to me when I perform a request in curl. Could you help me with this mistake? Could you tell me where I'm going wrong?
Segue requisição curl:
curl -X 'POST' \
'https://portoapicloud-hml.portoseguro.com.br/oauth/v2/access-token' \
-H 'accept: application/json' \
-H 'Authorization: Basic NjZiNWJmMWI4MDE0NDExMWE1MGYwMWMyYmUxZjFiZDY6YzIwMGEwNzZlNmFkNDBkYThkYTkwODQ2YWI4OTI3MjU=' \
-H 'Content-Type: application/json' \
-d '{
"grant_type": "client_credentials"
}'
Related
I am still receiving access_denied error even I have setup the required configuration I have found on Auth0 documentation https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-the-authorization-code-flow#authorize-user
I have already enabled Implicit, Authorization Code, Refresh Token, Client Credentials on my application grant_types and enabled Refresh Token Rotation too.
I have tried researching more about this but I can't find anything on google as I am probably the first one encountering this? Or probably I am missing something out here.
here's the sample curl request I have
curl --location --request POST 'https://{MY_AUTH0_DOMAIN}/oauth/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--header 'Cookie: did=s%3Av0%3A6b3f22c0-ac00-11ec-b070-
0b6e59231b0a.LT0c0bBGB4EukRqKLcGtHtt9t%2B3YtiQ1nQ07bfKCkyU;
did_compat=s%3Av0%3A6b3f22c0-ac00-11ec-b070-
0b6e59231b0a.LT0c0bBGB4EukRqKLcGtHtt9t%2B3YtiQ1nQ07bfKCkyU' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'client_id={MY_CLIENT_ID}' \
--data-urlencode 'refresh_token=v1.MemAxcxZBez46BV3cDnUo97zIY_lfNDi15XTCDJr5tQKbrEvnZzBjiVNvtOfrny3A0QD1AsoUDLJETl3rFkzLMM'
I found the issue, in their documentation https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-the-authorization-code-flow#authorize-user it doesn't require you to pass client_secret but it is needed when you do request for a refresh_token. Found it here https://community.auth0.com/t/use-refresh-tokens-in-node-js-and-axios-receiving-401-error-access-denied-unauthorized/79615
I am able to login my local (and remote server) with the following curl (which I generated using Postman)... and I can login successfully using another API Client (Rested) with the same params/headers/body that I am trying to use in Postman. I've turned off "SSL cert verification" and "Send Postman Token header" in settings (per other Stack Overflow answers).. but still getting an unauthorized response from server when using Postman (but not when using curl or Rested)
curl:
curl -X POST \ http://localhost:8080/api/user/login \ -H 'Accept:
application/json' \ -H 'Content-Type: application/json' \ -d '{
"email": "email#example.com",
"password": "examplemail**" }'
And here is my log..
I just solved my own Q.. and posting this answer because I've seen other questions re: curl working but postman not on SO and Postman communities. My solution was to check the Content-Length header and Connection headers. They were auto populating anyway, so after 'accepting' them as headers, the Postman request worked. Here is a screenshot of the headers that worked.
I'm trying to use the Active Collab API to retain project information for reporting purposes. I basically just want to make a daily API call and safe the JSON for further reporting in another tool.
For this reason I don't want to use an SDK or anything, just a plain API call to retain the data.
Can someone please guide me because I couldn't find the correct url structure for a self-hosted system.
I found a solution with the help from the support.
First you have to obtain a token like this:
curl --location --request POST 'https://YOUR.SITE/api/v1/issue-token' \
--header 'Content-Type: application/json' \
--data-raw '{
"username" : "YOUR EMAIL",
"password" : "YOUR PASSWORD",
"client_name" : "xxx",
"client_vendor" : "xxx"
}'
And in the next step you can use the API as documented here by calls like this one:
curl --location --request GET 'https://YOUR.SITE/api/v1/projects' \
--header 'Content-Type: application/json' \
--header 'X-Angie-AuthApiToken: YOUR TOKEN'
How to get jwt token in single step(api call) from aws cognito oauth2/token endpoint passing username and password
curl --location --request POST 'https://xxx.auth.us-east-2.amazoncognito.com/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic a......k' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=t34...nu'
--Authorization base64ecoded username:password
Response- "error": "invalid_client"
App client settings :
Allowed OAuth Flows : Authorization code grant, Implicit Grant
Allowed OAuth scope : email , openid
App clients : ALLOW_USER_PASSWORD_AUTH
I tried oauth2/authorize too but getting html page in response
There's no need to add the Authorization header. Instead, use the code you see in the URL. This worked for me.
curl --location --request POST 'https://xxx.auth.us-east-2.amazoncognito.com/oauth2/token'
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode 'grant_type=client_credentials'
--data-urlencode 'client_id=t34...nu'
--data-urlencode 'code=afa78ac6-..-b8dd-5b'
--data-urlencode 'redirect_uri=path'
The client credentials flow to the token endpoint is to receive an access token for machine to machine communication. It is not based on a given user so no user name and password is required.
See 'Exchanging Client Credentials for an Access Token'
https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html
To sign in with the oauth endpoints it is intended to do this via the HostedUI or an external IDP. However, you can do it pro-grammatically but will require a call to authorize and login endpoint.. You can see an example in python here:
https://github.com/starkshaw/aws-cognito-user-pool-custom-scope
This is a late answer, but following worked for me nicely with a client_credentials workflow.
curl --request POST \
--url 'https://XYZ.auth.us-west-2.amazoncognito.com/oauth2/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--data grant_type=client_credentials \
--data client_id=7*******e \
--data client_secret=2*****5pjk9valn
Here is the response I got:
{"access_token":"eyJra*****eA","expires_in":3600,"token_type":"Bearer"}
I am trying to use the yelp fusion api but cannot seem to find out how to format the url. I have read the get started page but do not understand it. I just need to know where to put what. This is what I have so far:
https://api.yelp.com/oauth2/token?grant_type=client_credentials&client_id=ID&client_secret="CLIENT SECRET"
When I load this url it says "VALIDATION_ERROR." What am I doing wrong?
The grant_type,client_id and client_secret should be sent in application/x-www-form-urlencoded format in the POST call.
curl -X POST \
https://api.yelp.com/oauth2/token \
-H 'cache-control: no-cache' \
-H 'content-type: application/x-www-form-urlencoded' \
-d 'grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET'