# 403 forbidden from token endpoint **URL:** \ **Category:** OAuth/OIDC\ **Tags:** api\ **Created:** [June 17, 2020, 1:54pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812 "2020-06-17T13:54:58Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 17, 2020, 1:54pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/1 "2020-06-17T13:54:58Z")
Hello I am trying to access the token endpoint from my javascript Cordova application and I am getting the 403 Forbidden error. I have verified that the client\_id and other parameters are accurate by running the same scenario through Postman, but when I run the same request from my application I get the 403 error. I can get the authorization\_code in the app as well as receive the access\_token and id\_token if I call the authorization endpoint with id\_token and token, however when I try the PKCE route I am running into that 403 Forbidden error. I have had the issue with PKCE from a “Native” app. I have also tried a “Web” app but have gotten the same results. All seems to work through Postman but then I get the 403 Forbidden error in the app. ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [June 17, 2020, 5:15pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/2 "2020-06-17T17:15:13Z")
Are you using Ionic + Cordova or just JavaScript? The reason I ask is because I’ve successfully used [Ionic AppAuth](https://github.com/wi3land/ionic-appauth) to integrate authentication with Okta. ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 17, 2020, 6:30pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/3 "2020-06-17T18:30:15Z")
I don’t intend to use Ionic, it is just a JavaScript app. ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [June 17, 2020, 6:54pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/4 "2020-06-17T18:54:28Z")
I’ll admit. I haven’t tried to use our APIs with raw JavaScript. I tend to use a library, like [AppAuth-JS](https://github.com/openid/AppAuth-JS). ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 17, 2020, 7:01pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/5 "2020-06-17T19:01:59Z")
Okay, I can look into that library. Just seems a bit strange that Postman will connect through fine while using the “code” from Postman does not. ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [June 18, 2020, 12:34am UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/6 "2020-06-18T00:34:08Z")
Hi @whodeee Can you please check [https://github.com/dragosgaftoneanu/okta-js-scripts/blob/master/auth-code-flow-pkce-spa/index.html](https://github.com/dragosgaftoneanu/okta-js-scripts/blob/master/auth-code-flow-pkce-spa/index.html)? This sample does authorization code flow with PKCE in native JavaScript and gets the JWTs from Okta. ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 18, 2020, 1:15pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/7 "2020-06-18T13:15:27Z")
Thanks @dragos, I’ll check it out and let you know. ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 23, 2020, 2:49pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/8 "2020-06-23T14:49:43Z")
@dragos and @mraible I was able to solve my issue! I had to add “file://” to my Trusted Origin as well as adding it as a Redirect\_URI for my app, then all worked well. Any issues you see using that? ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [June 23, 2020, 6:29pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/9 "2020-06-23T18:29:39Z")
Were you able to add `file://` as a Trusted Origin on Okta? I didn’t think that was possible. I thought only `http://` and `https://` was supported. ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 24, 2020, 2:09pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/10 "2020-06-24T14:09:28Z")
Yes, I was able to add it - specifically file://localhost:{portnumber} ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 26, 2020, 6:27pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/11 "2020-06-26T18:27:49Z")
@dragos and @mraible do either of you seen any issues with that Trusted Origin? ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [June 29, 2020, 5:17am UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/12 "2020-06-29T05:17:41Z")
Hi @whodeee There was a previous issue with adding `file://` as extension for the URL, but it has been resolved, so the application should work successfully. 🙂 ---
**Author:** ![whodeee](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/whodeee/32/1503_2.png) [@whodeee](https://devforum.okta.com/u/whodeee)\ **Post date:** [June 29, 2020, 1:12pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/13 "2020-06-29T13:12:13Z")
Thanks @dragos I thought I saw some mention of that before, but I couldn’t find where. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [January 25, 2024, 4:51pm UTC](https://devforum.okta.com/t/403-forbidden-from-token-endpoint/9812/14 "2024-01-25T16:51:36Z")
Closed on January 25, 2024, 4:51pm UTC This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.