OAuth2：Discord API 总是响应 {“error”: “invalid_grant”}

Question

I am trying to implement Discord OAuth2 in my node.js Application. As soon as I try to get the access token from the given authorization code, I always get the HTTP response Error 400 {"error": "invalid_grant"}

let xhr = new XMLHttpRequest()
xhr.open('POST', 'https://discord.com/api/oauth2/token')

xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')

let payload ={
    client_id: clientID,
    client_secret: clientSecret,
    grant_type: 'authorization_code',
    code: code,
    redirect_uri: redirectUrl,
    scope: 'identify'
};

console.log(payload)
xhr.send(JSON.stringify(payload))

xhr.onreadystatechange = () => {
    console.log(xhr.status)
    console.log(xhr.responseText)
}

xhr.onerror = () => {
    console.log('Failed')
}

Answer 1

Okay I solved the issue. For everyone who is experiencing the same issue that I had, I solved it by using axios and querystring to send the POST request to the Discord API ( https://github.com/discord/discord-api-docs/issues/1131 )

It seems that there is a problem with the JSON and the x-www-form-urlencoded format.

Answer 2

I had the same issue when trying to use on Next.js's GetServerSideProps function.

After searching a lot, I found an closed issue on Github solving this problem ( Github Issue: Deep Linking with OAuth2 Not Working ). Basically, we could not use JSON object on authentication request's body. We must use URLSearchParams object instead.

The payload should look like:

const payload = new URLSearchParams()

payload.append('client_id', process.env.DISCORD_CLIENT_ID)
payload.append('client_secret', process.env.DISCORD_CLIENT_SECRET)
payload.append('grant_type', 'authorization_code')
payload.append('redirect_uri', process.env.DISCORD_REDIRECT_URI)
payload.append('code', accessCode)
payload.append('scope', 'identify')

Answer 3

payload should not be a js object but a form data ie

let payload = new FormData();
payload.append("key in string","value in string")

Answer 4

In my case, it was a very silly error. Instead of "response_type", I sent "response_type " (with a space); I randomly realized when I printed the HTML-formatted string and saw a %20 Make sure the parameters have the correct names!