# Issue with POST /token **URL:** \ **Category:** OAuth/OIDC\ **Created:** [March 27, 2019, 1:15am UTC](https://devforum.okta.com/t/issue-with-post-token/4633 "2019-03-27T01:15:52Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jayrc](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jayrc](https://devforum.okta.com/u/jayrc)\ **Post date:** [March 27, 2019, 1:15am UTC](https://devforum.okta.com/t/issue-with-post-token/4633/1 "2019-03-27T01:15:52Z")
I am making a POST request in POSTMAN with the following URL: https://{oktaDomain}/oauth2/default/v1/token Body: - grant\_type: refresh\_token - redirect\_uri: {localhost} - scope: openid offline\_access - refresh\_token: {refresh\_token} Headers: - Accept: application/json - Authorization: Bearer {accessToken} - Content-Type: application/x-www-form-urlencoded I am receiving the following error: { “error”: “invalid\_client”, “error\_description”: “No client credentials found.” } Do I need to pass in a client\_id and client\_secret? Any help is appreciated, thank you ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [March 27, 2019, 2:53pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/2 "2019-03-27T14:53:33Z")
Hi @jayrc For requesting a new access token, as per the example available [here](https://developer.okta.com/authentication-guide/tokens/refreshing-tokens/#get-a-refresh-token-silently-for-your-spa), you will need to pass client id and client secret in the authorization header in the format of _"Authorization: Basic " + base64\_encode(client\_id + “:” + client\_secret)_ or in the body of the POST request. ---
**Author:** ![jayrc](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jayrc](https://devforum.okta.com/u/jayrc)\ **Post date:** [March 27, 2019, 3:19pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/3 "2019-03-27T15:19:27Z")
Hello @dragos, This is what my request looks like (I’ve removed my client\_id, client\_secret, host, refresh\_token for privacy reasons): POST /oauth2/default/v1/token HTTP/1.1 Host: {host} Content-Type: application/x-www-form-urlencoded Accept: application/json Cache-Control: no-cache Body grant\_type=refresh\_token&redirect\_uri=http%3A%2F%2Flocalhost%3A8080&scope=offline\_access+openid&refresh\_token={refresh\_token}&client\_id={client\_id}&client\_secret={client\_secret} Response: { “error”: “invalid\_request”, “error\_description”: “The grant was issued for another authorization server.” } ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [March 27, 2019, 3:25pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/4 "2019-03-27T15:25:11Z")
Hi @jayrc The error here is that the refresh token was issued through a different authorization server and can not be used on the “default” custom authorization server. If the previous access/bearer token and refresh token were issued through the same authorization server, then you can use a tool like [https://jsonwebtoken.io](https://jsonwebtoken.io) to decode the access token and see what is the issuer (it should look like “[org.okta.com](http://org.okta.com)”, “[org.okta.com/oauth2/default](http://org.okta.com/oauth2/default)” or “[org.okta.com/oauth2/](http://org.okta.com/oauth2/)”) Depending on the case, if you have “/oauth2/”, then you will need to change the request path and modify “default” to what is written there. If it simply returns “[org.okta.com](http://org.okta.com)”, then you will need to use the Okta authorization server with the path `/oauth2/v1/token`. ---
**Author:** ![jayrc](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jayrc](https://devforum.okta.com/u/jayrc)\ **Post date:** [March 27, 2019, 3:29pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/5 "2019-03-27T15:29:17Z")
Hello @dragos, I decoded the access\_token and it shows the issuer as “{org}.okta.com”. I tried the POST request again with the following URL: https://{org}.okta.com/oauth2/v1/token – but I’m receiving the following: { “error”: “invalid\_client”, “error\_description”: “Client authentication failed. Either the client or the client credentials are invalid.” } In my authorization header, should I be using “Basic {accessToken}” or “Bearer {accessToken}”? ---
**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\ **Post date:** [March 27, 2019, 3:33pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/6 "2019-03-27T15:33:52Z")
Hi @jayrc Please use Basic and a base 64 encoding of client id, column and client secret instead of access token. The algorithm looks like the following `Authorization: Basic " + base64_encode(client_id + “:” + client_secret)` If you are testing this through Postman, please add the client ID and client secret under Authorization \>\> Type \>\> Basic Auth. For username, please add the value for client ID and, for password, the value for client secret. ---
**Author:** ![jayrc](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jayrc](https://devforum.okta.com/u/jayrc)\ **Post date:** [March 27, 2019, 3:39pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/7 "2019-03-27T15:39:39Z")
Hello @dragos, That worked perfectly. Thank you for the help and quick responses, have a great day! ---
**Author:** ![Neojet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/neojet/32/2583_2.png) [@Neojet](https://devforum.okta.com/u/Neojet)\ **Post date:** [February 8, 2021, 9:53am UTC](https://devforum.okta.com/t/issue-with-post-token/4633/8 "2021-02-08T09:53:06Z")
Hello @dragos, I wanna test through Postman to get an acces token with client credentials flow, but it’s doesn’t work I got in body urlencoded : grant\_type : client\_credentials, scope: goodone headers : Accept : application/json Authorization : like you said for Username : client\_id and Password : Client\_secret and i got this error :o ![image](https://global.discourse-cdn.com/oktadev/original/2X/1/196061a9852551f66bfec6fa11fcd9cb30e0a261.png) What i’m doing wrong ? i don’t have to use “clientid:client\_secret” encode as base64 for postman so ? Thank you for your help ! ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 8, 2021, 4:39pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/9 "2021-02-08T16:39:10Z")
What is your use case, @Neojet? The error you are shown tells me you are making this request to [https://oktaDomain/oauth2/v1/token](https://oktaDomain/oauth2/v1/token), which is the token endpoint for the [Org Authorization server](https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server), and will only work if you are looking to get OAuth tokens to use against Okta APIs, as described [here](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/overview/). That guide tells you how to create a service app with private\_key\_jwt auth instead of a client secret to use at the Org Authorization server. If you are instead trying to get tokens to use against your own server, you must use a Custom Authorization Server, which typically requires having the API Access Management license available for your org. You can tell if you have this option by logging into the admin console and navigating to **Security → API → Authorization Servers**. If you have this drop-down option listed, you will see a list of the existing custom authorization servers available for your org. If this is your use case and you see these servers, you will need to 1) create a custom scope that your machine-to-machine application can request and 2) update your /token call to use one of these servers as the issuer and ensure you are requesting this additional scope. For example, instead of calling [https://oktaDomain/](https://oktaDomain/) **oauth2/v1/token** , you can instead call [https://oktaDomain/](https://oktaDomain/) **oauth2/default/v1/token** if you have the “default” authorization server available, which is created for you in your org when the API Access Management feature is enabled. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [January 26, 2024, 11:36pm UTC](https://devforum.okta.com/t/issue-with-post-token/4633/10 "2024-01-26T23:36:24Z")