# Oauth2 works in Postman but getting 400 in code

**URL:** <https://devforum.okta.com/t/oauth2-works-in-postman-but-getting-400-in-code/27068>\
**Category:** OAuth/OIDC\
**Created:** [February 29, 2024, 5:45pm UTC](https://devforum.okta.com/t/oauth2-works-in-postman-but-getting-400-in-code/27068 "2024-02-29T17:45:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterh1](https://avatars.discourse-cdn.com/v4/letter/p/b9bd4f/32.png) [@peterh1](https://devforum.okta.com/u/peterh1)\
**Post date:** [February 29, 2024, 5:45pm UTC](https://devforum.okta.com/t/oauth2-works-in-postman-but-getting-400-in-code/27068/1 "2024-02-29T17:45:42Z")

</div>

I was running this through Postman and everything seems to work, but using code it failed.

When running this through Postman works:

https:// [[yourdomain.okta.com/oauth2/v1/token](http://yourdomain.okta.com/oauth2/v1/token)

with body params of:

grant\_type authorization\_code

client\_id YOURCLIENTID

redirect\_uri REDIRECTURI

code AUTHORIZATION CODE FROM /authorize

code\_verifier CODEVERIFIER

## But running through Java code after getting the ‘code’ value:

```
       HashMap<String, String> headers = new HashMap<>();
        headers = new HashMap<>();
        headers.put("Content-Type", "application/x-www-form-urlencoded");
        headers.put("Accept", "*/*");
        headers.put("Connection", "keep-alive");

        JSONObject requestParams = new JSONObject();
        requestParams.put("grant_type", "authorization_code");
        requestParams.put("client_id", some_client_id);
        requestParams.put("redirect_uri", some_callback_url);
        requestParams.put("code_verifier",some_code_verified);
        requestParams.put("code", code);

        RestAssured.baseURI = accessTokenURL;
        RequestSpecification request = SerenityRest.given();   
        request.headers(headers);
        request.body(requestParams.toString());
        Response post = request.post();

```

# Getting the following response:

{  
“errorCode”: “invalid\_client”,  
“errorSummary”: “A client\_id must be provided in the request.”,  
“errorLink”: “invalid\_client”,  
“errorId”: some\_error\_id,  
“errorCauses”: [

```
]

```

}

These seems to be the exact parameters used in Postman, am Im missing something (ie: like client\_secret\_id) ?

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [February 29, 2024, 10:51pm UTC](https://devforum.okta.com/t/oauth2-works-in-postman-but-getting-400-in-code/27068/2 "2024-02-29T22:51:10Z")

</div>

Hi @peterh1! Yes, `grant_type=authorization_code` requires a client\_secret per - [OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#request-example-2) when calling the token endpoint. Please try again and confirm.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [March 30, 2024, 10:51pm UTC](https://devforum.okta.com/t/oauth2-works-in-postman-but-getting-400-in-code/27068/3 "2024-03-30T22:51:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.