Coinbase Oauth2 - token request URL - "404 Not found"

Question

First steps of the Coinbase Oauth Authorization seem to work fine. I request the customer code via the following URL:

"https://www.coinbase.com/oauth/authorize?response_type=code&client_id=XXXXXXXXXXXXXXXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&scope=user+balance"

I get back the code via URL.. Then trying to request the token with given CODE and CLIENT SECRET and CLIENT ID:

"https://api.coinbase.com/oauth/token&grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX"

With that I get an "404 Not found" Error..

Is there any obvious mistake in the URL.. or is it most likely an issue with the Code or Secret etc. itself? If Yes.. anything important to know there?

All that was followed from the description: https://developers.coinbase.com/docs/wallet/authentication

Thank you so much for help!

Answer 1

Requesting it as a POST BODY did the job! Although important changes: - Redirect uri needs to be a proper external domain, uri for mobile apps will create a 401 Error.. -Encoding in ascii

            import urllib
            import urllib.request
            import urllib.parse
            data = urllib.parse.urlencode({'grant_type':'authorization_code', 'code': 'XXXXXX', 
            'redirect_uri': 'https://XXXXXX', 'client_id': 'XXXXXXXXXXX', 
            'client_secret' : 'XXXXXXXXXXX'})
            binary_data = data.encode('ascii')

            try:
                response = urllib.request.urlopen('https://api.coinbase.com/oauth/token', data=binary_data)
                print(response.status)
                print(response.read())
            except urllib.error.HTTPError as e:
                print('%s %s' %(e.code, e.reason))

Got the rough structure from: https://docs.python.org/3/library/urllib.request.html

Thanks a lot for the fast help!

Answer 2

The URL that you pasted:

https://api.coinbase.com/oauth/token&grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX

does not contain a query component since there's no ? character in there. You should rather use:

https://api.coinbase.com/oauth/token?grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX

and it looks like the documentation that you point to is the source of that error.

Moreover, the OAuth 2.0 spec says to use POST to the token endpoint, which is also stated in the docs but not clearly demonstrated in the sample. So you should send the parameters as form-encoded values an HTTP POST, e.g. the equivalent of the following cURL request:

curl -d "grant_type=authorization_code&code=XXXXXXX&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=XXXXXXX&client_secret=XXXXXXX" https://api.coinbase.com/oauth/token