# Browserless Session Token =\> Authorization Code Exchange

**URL:** <https://devforum.okta.com/t/browserless-session-token-authorization-code-exchange/20981>\
**Category:** OAuth/OIDC\
**Created:** [June 15, 2022, 3:22pm UTC](https://devforum.okta.com/t/browserless-session-token-authorization-code-exchange/20981 "2022-06-15T15:22:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwilliams](https://avatars.discourse-cdn.com/v4/letter/j/c2a13f/32.png) [@jwilliams](https://devforum.okta.com/u/jwilliams)\
**Post date:** [June 15, 2022, 3:22pm UTC](https://devforum.okta.com/t/browserless-session-token-authorization-code-exchange/20981/1 "2022-06-15T15:22:48Z")

</div>

Hello, my team has a use case that requires end users to be able to log on without access to a web browser. We are using Okta as an external OpenID Provider and following this [How-To](https://support.okta.com/help/s/article/How-to-get-tokens-for-an-OIDC-application-without-a-browser-using-curl-Postman?language=en_US) document that involves exchanging a session token for an authorization code. Our application can execute the Authorization Code Flow to retrieve id/access/refresh tokens.

Here are the steps we are taking:

1. The user completes [Primary authentication](https://developer.okta.com/docs/reference/api/authn/#primary-authentication-with-public-application) using curl or some other CLI utility generating a `sessionToken`

2. The user copies the `sessionToken` value from the Primary authentication response and forwards it to our client app.

3. Our client app constructs an authorization URL with the proper parameters, including `sessionToken`. Here is an example:

```auto
https://{okta_domain}/oauth2/v1/authorize?response_type=code&response_mode=form_
post&client_id=0oa1b33v3p5Sa6mAt697&redirect_uri=https://localhost:6050/oauth2/v1/test/code_callback&state=eyJvY19yZXFfaWQiOiIyZTA3MzhlYi1mMjIxLTQyNWYtYWJjYi0wMDgyNmIxMGI0MzIiLCJvY19kYl9pZCI6ImQ5NjFlOTM5LTE5ZmUtNGNmOS1iYmZiLWUyMGIxY
WYwZjMwNCIsIm9jX2Zsb3ciOjJ9&scope=openid%20email%20profile%20groups&prompt=none&sessionToken={{sessionToken}}

```

1. Client app sends GET request to the authorization URL. We expect Okta to use the `sessionToken` as a form of authentication and immediately redirect the client app back to itself with the authorization code. However, the following error is being returned to the client app:

```auto
{"request_id":"2e0738eb-f221-425f-abcb-00826b10b432","timestamp":"1655304888","database":"test","error_code":"GENERAL_ERROR","state":"eyJvY19yZXFfaWQiOiIyZTA3MzhlYi1mMjIxLTQyNWYtYWJjYi0wMDgyNmIxMGI0MzIiLCJvY19kYl9pZCI6ImQ5NjFlOTM5LTE5ZmUtNGNmOS1iYmZiLWUyMGIxYWYwZjMwNCIsIm9jX2Zsb3ciOjJ9","error_description":"the client specified not to prompt, but the user is not logged in."}

```

Is the `sessionToken` insufficient? Are there additional headers that Okta expects when receiving the authorization request? Any assistance on this is greatly appreciated!

FWIW, the client application is using a [libcurl wrapper](https://github.com/libcpr/cpr) to execute the authorization request.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [June 17, 2022, 8:28pm UTC](https://devforum.okta.com/t/browserless-session-token-authorization-code-exchange/20981/2 "2022-06-17T20:28:57Z")

</div>

Responded in your other thread, closing this one: [Can I exchange a Session Token retrieved via Primary Authentication for an Authorization Code - #2 by andrea](https://devforum.okta.com/t/can-i-exchange-a-session-token-retrieved-via-primary-authentication-for-an-authorization-code/20987/2)

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [June 17, 2022, 8:29pm UTC](https://devforum.okta.com/t/browserless-session-token-authorization-code-exchange/20981/3 "2022-06-17T20:29:00Z")

</div>