Box OAuth2 token exchange needs form-encoded params and the right Content-Type

Not specified by the original author.

Box OAuth2 token exchange needs form-encoded params and the right Content-Type

TL;DR

When the Box token endpoint rejects your grant, check the request encoding before anything else: send the fields as form-urlencoded with the matching Content-Type header, URL-encode the values, and only include redirecturi if you used it in the authorize step, with identical values in both places. Context: Stack Overflow #15269989 (accepted answer, 20 votes): the asker posted every OAuth2 field correctly yet kept getting invalidgrant_type or parameter missing from the Box token endpoint.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

The accepted answer found the real cause: Box requires the token request body to be form-urlencoded with the header Content-Type set to application/x-www-form-urlencoded, plus proper URL encoding of the parameters. It also cites the OAuth2 spec detail that redirect_uri is only required at the token step if it was included in the authorization request, and then the two values must match exactly.

Source: Stack Overflow #15269989 (accepted answer, 20 votes): the asker posted every OAuth2 field correctly yet kept getting invalidgranttype or parameter missing from the Box token endpoint. The accepted answer found the real cause: Box requires the token request body to be form-urlencoded with the header Content-Type set to application/x-www-form-urlencoded, plus proper URL encoding of the parameters. It also cites the OAuth2 spec detail that redirect_uri is only required at the token step if it was included in the authorization request, and then the two values must match exactly.

Verified resolution: When the Box token endpoint rejects your grant, check the request encoding before anything else: send the fields as form-urlencoded with the matching Content-Type header, URL-encode the values, and only include redirect_uri if you used it in the authorize step, with identical values in both places.

Source URL: https://stackoverflow.com/questions/15269989/box-oauth2-invalid-grant-type-parameter-or-parameter-missing