error: "unsupported_grant_type" from django oauth2 server

Question

Not sure why django won't accept my POST request for an access token. All my parameters are correct and I already have the authorization code, but a follow-up POST request for the access token gives me this error.

Content-type is correct from what I read from others. If the pkce side was non-accurate it would give me a more specific error about that.

HttpErrorResponse is { error: "unsupported_grant_type" } 400 bad request

 requestToken(code: string, state: string) {
  const clientState = sessionStorage.getItem('pkce-state');
   if (clientState !== state) {
    console.error('States do not match!');
   }

  const verifier = sessionStorage.getItem('pkce-verifier');

  const params = new URLSearchParams({
   grant_type: 'authorization_code',
   redirect_uri: 'http://localhost:4200/dashboard',
   client_id: 'client_id',
   code,
   state,
   verifier
 });

return this.http.post('http://localhost:8000/o/token/',
  {
    params
  },
  {
    withCredentials: true,
    headers: new HttpHeaders({
        'Content-Type': 'application/x-www-form-urlencoded'
      }
    )
  });

}

Also tried this:

requestToken(code: string, state: string) {
  const clientState = sessionStorage.getItem('pkce-state');
   if (clientState !== state) {
     console.error('States do not match!');
   }
  const verifier = sessionStorage.getItem('pkce-verifier');

  return this.http.post('http://localhost:8000/o/token/',
    {
      grant_type: 'authorization_code',
      redirect_uri: 'http://localhost:4200/dashboard',
      client_id: 'client_id',
      code,
      state,
      verifier
    },
    {
      withCredentials: true,
      headers: new HttpHeaders({
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'application/json'
      }
    )
  });

}

Answer 1

Try matching step 7 of my write up precisely :

• Use code_verifier
• Get rid of the state parameter, which is not needed on a direct https message to the token endpoint

Error messages are often misleading but this will make your message 100% standard and hopefully will work.

Then again, always possible that Django doesn't support this flow properly ...