如何使用ruby从Infusionsoft的Oauth获取访问令牌？

Question

We're integrating our ruby on rails 4 app with Infusionsoft's XML-RPC API through their 3-legged Oauth2 implementation.

(Documentation here - https://developer.infusionsoft.com/docs/xml-rpc/#authentication-request-permission )

We set up a redirect action to send the user to the Infusionsoft application authentication page with our app's ID.

def connect_inf
    redirect_to "https://signin.infusionsoft.com/app/oauth/authorize?client_id=XXXXXXX&redirect_uri=https://testappurl.herokuapp.com/websites/1/connect_inf/callback/&response_type=code&scope=full"
end

Then, after the user authenticates, the user gets sent back to our callback action with a URL looking like this...

https://testappurl.herokuapp.com/websites/1/connect_inf/callback?scope=full|theirappdomain.infusionsoft.com&code=XXXXXXX

Where we get the code and use RestClient to post it back to Infusionsoft to request the access token, with the parameters in the order they specify in their documentation.

def get_inf
    response = RestClient.post 'https://api.infusionsoft.com/token', :client_id => 'XXXXXXXXXXXXXX', :client_secret => 'XXXXXXX', :code => params[:code], :grant_type => 'authorization_code', :redirect_uri => 'https://testappurl.herokuapp.com/websites/1/connect_inf/callback/', :accept => 'text/xml'
end

This returns RestClient::BadRequest: 400 Bad Request

I assume this has something to do with how parameters are being delivered.

Answer 1

For the reference of ruby developers accessing Infusionsoft's API, this was caused by a number of issues caused by using dynamic redirect and callback URLs. Infusionsoft whitelists one callback URL you provide when registering your app.

I was able to solve this by using an OmniAuth strategy for Infusionsoft and using OmniAuth to access the tokens.

https://github.com/L1h3r/omniauth-infusionsoft

We pointed the default omniauth callback path "/auth/infusionsoft/callback" to a controller action in our routes.

get '/auth/:provider/callback', to: 'websites#get_inf'

Where we were able to access the tokens like so...

def get_inf
    access_token = env["omniauth.auth"]['credentials']['token']
    refresh_token = env["omniauth.auth"]['credentials']['refresh_token']
    expires_at = env["omniauth.auth"]['credentials']['expires_at']
end

You could then save these tokens to a user object for example.