OAuth2Error at /auth/google/ Invalid id_token f"Invalid token type. Token must be a {bytes}")

Question

According to the dj-rest-auth Social Auth steps, I have added all the necessary apps in the INSTALLED_APPS section

I want to login with Google, so under the Google steps, I have added the google provider, created the view and added the URL.

On my frontend, after login, I get this

email: "[email protected]"
firstName: "name"
id: "10xx"
idToken: "eyJhbGciOiJSU-xxx"
lastName: "name"
name: "name"
photoUrl: "https://lh3.googleusercontent.com/a/AC-xxx"
provider: "GOOGLE"

I listen to the AuthState changes, and make a payload request to the backend as

  ngOnInit() {
    this.authService.authState.subscribe((user) => {
      const token = user.idToken;
      this.http.post('http://localhost:8000/auth/google/', {
        access_token: token
      }).subscribe(res => {
        console.log(res);
      })
    });
  }

Doing the above throws the error:

OAuth2Error at /auth/google/
Invalid id_token

"Ah, but why aren't you sending in id_token but rather using access_token?", you ask.

According to the OPTIONS of the /auth/google/ endpoint, these are expected

"actions": {
        "POST": {
            "access_token": {
                "type": "string",
                "required": false,
                "read_only": false,
                "label": "Access token"
            },
            "code": {
                "type": "string",
                "required": false,
                "read_only": false,
                "label": "Code"
            },
            "id_token": {
                "type": "string",
                "required": false,
                "read_only": false,
                "label": "Id token"
            }
        }
    }

But then doing

     this.http.post('http://localhost:8000/auth/google/', {
        id_token: token
      })

throws the error from the API as "Incorrect input. access_token or code is required."

I'm using

• dj-rest-auth==5.0.1
• django-allauth==0.58.2
• djangorestframework==3.14.0

Are there step not covered (won't be the first time) in the docs I'm missing?

Edit: I do not wanna downgrade

Answer 1

Check that access_token and id_token are both in your request. use access_token and id_token in your POST request, if idToken is in fact the access token in your Angular code.

So add the line for id_token within your request

this.http.post('http://localhost:8000/auth/google/', {
    access_token: accessToken,
    id_token: idToken