当我使用 Discord OAuth2 时，我收到错误 400。我怎样才能让它正确返回 access_token？

Question

I am unable to get the clients identiy through discords oauth2. First we do this:

https://discord.com/api/oauth2/authorize?client_id=9999999999999&redirect_uri=http%3A%2F%2Fxxxx.xyz%2F&response_type=code&scope=identify

to get their code. Which seems to work fine.

let options = {
  url: 'https://discord.com/api/oauth2/token',
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams({
    'client_id': '9999999999999',
    'client_secret': 'MYSECRETHERE',
    'grant_type': 'authorization_code',
    'code': code,
    'redirect_uri': 'https://xxxx.xyz/callback',
    'scope': 'identify'
  }).toString()
};


   await fetch("https://discord.com/api/oauth2/token", options)
    .then(handleErrors)
    .then(response => response.json())
    .then(response => {
        access_token = response.access_token;
    }).catch(function(error) {
        console.log(error);
    });

What happens here is I get a error 400 instead of the access token. Originally the 'grant_type' was set as client_credientals but I realized that this only grabs the identity of the application owner itself, not others. This worked however. Changing it to authorization_code however does not.

Any suggestions?

Answer 1

Compared to the token exchange example , you are passing scope in the request – that shouldn't be there. Scope is passed only in the initial authorization URL.