Question

当根据their documentation/guide向Google OAuth2 API发出请求时，即使我发誓我会提供所有必填字段，我仍然从https://accounts.google.com/oauth2/v4/token收到401 Unauthorized响应：

POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
User-Agent: curl/7.47.0
Accept: */*
Content-Length: 311
Content-Type: application/x-www-form-urlencoded

client_id=REDACTED
&client_secret=REDACTED
&code=REDACTED
&grant_type=authorization_code
&redirect_uri=https%3A%2F%2Flocalhost%2Fsso%3Fredirect%3D%252F

响应：

HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
Vary: X-Origin
Vary: Referer
Date: Wed, 03 Jul 2019 16:14:15 GMT
Server: scaffolding on HTTPServer2
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: quic=":443"; ma=2592000; v="46,43,39"
Accept-Ranges: none
Vary: Origin,Accept-Encoding
Transfer-Encoding: chunked

{
  "error": "invalid_client",
  "error_description": "Unauthorized"
}

我已经检查并三重检查了我的client_id，client_secret，授权主机和redirect_uri，并在堆栈溢出时查看了类似的问题，但是似乎没有任何作用...为什么这对我来说是：（

Answer 1

这是因为Google的指南/文档对您说谎。那不是正确的终点，而不是这么说，它给了您极其无用的错误信息。希望他们会意识到此SO帖子/答案并予以解决。要找出用于获取授权令牌的 actual 网址，您可以点击console.developers.google.com上凭据视图页面上的“下载JSON”按钮，而不仅仅是复制/粘贴client_id和client_secret。然后您将获得如下所示的内容：

{
    "web": {
        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
        "client_id": "REDACTED",
        "client_secret": "REDACTED",
        "javascript_origins": [
            "https://localhost"
        ],
        "project_id": "REDACTED",
        "redirect_uris": [
            "https://localhost/sso?redirect=%2F"
        ],
        "token_uri": "https://oauth2.googleapis.com/token"
    }
}

就在那里。 REAL 令牌URI。

Google OAuth2端点总是说无效的客户端ID

1 个答案: