I'm using SS2.0 and N/https to call an external authorization server. This is the client authentication step of an OAuth 2.0 setup to get the bearer token. This call always results in a

invalid_client

error.

var bodyObj = {
	scope: xxxx,
	grant_type: 'client_credentials',
	client_id: xxxx,
	client_secret: xxxx
};

var response = <http://https.post|https.post>({
    url: xxxx,
    body: bodyObj
});

The help documentation states that passing an object to https.post defaults the headers to the correct context-type. I have also tried specifying the headers explicitly. I have made successful calls using Postman to verify the values. It seems there is some detail missing but I can't find it. Has anyone implemented an OAuth 2 client credentials grant successfully?

you need to stringy the JSON obj

It's actually the example right above that I was looking at. Is passes an object without stringifying and states the headers are set/overwritten. "If the body parameter is entered as an object, it is always encoded to the URL, and the headers are changed to "application/x-www-form-urlencoded; charset=UTF-8.”"

are you trying to do a form submit rather than sending JSON?

It uses

Content-Type: application/x-www-form-urlencoded

which matches with the OAuth standards that I've looked at.

gotcha yeah, okay so its might be failing cos you're sending the request from a server?... its supposed to be a client auth right? (which explains the form rather json) so there might be some header that NS is autosetting and sending indicating its coming from a NS server rather than a browser, and the auth server is like NOPE

That's kind of what I'm wondering. I'm sending the call from the script debugger and everything seems to match the Postman call. It seems there is something added or missing.

I've run into something similar before, not specifically for OAuth though... I think I never found a work around and just a totally different way to connect... sorry it was a while ago the details elude me

And it's the line that's half cut off in your screenshot that describes how passing an object as the body will change the headers.

right I'm on the same page with you from the initial use an object rather than JSON, and don't set the header 🙂

Right. I might have to get in touch with the vendor and see what visibility they have to the incoming request.

easiest is making the successful and failed request to an echo service like postman echo

Oh cool. I'll check that out.

If the server expects x-www-form-urlencoded for the data you will need to pass it this way

it usually doesnt matter, but encodeURIComponent doesnt encode spaces as +

Thanks for all the comments. I continue to test the various methods of doing this and comparing the calls using Postman echo. While I can't see meaningful differences, the call still returns an error. I'm reaching out to the vendor and hope they can identify the cause.