# Recieing (400) Bad Request When using Bearer Token Auth **URL:** \ **Category:** OAuth/OIDC\ **Created:** [September 19, 2023, 7:22pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350 "2023-09-19T19:22:53Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rickroca66](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@rickroca66](https://devforum.okta.com/u/rickroca66)\ **Post date:** [September 19, 2023, 7:22pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/1 "2023-09-19T19:22:53Z")
I have created a scrip to retrieve an Access\_token successfully. When I try to use the Token in a simple API request I receive (400) Bad Request. I am new to OAuth in Okta and not sure what is wrong. Below is more info **Token Grant Responce** token\_type expires\_in access\_token * * * Bearer 86400 eyJraWQiOiJ0WHhjRklJd3FfRXB (Truncated for sample) **Header Creation** $headers = New-Object “System.Collections.Generic.Dictionary[[String],[String]]” $headers.Add(“Authorization”, “Bearer $token”) **Rest Call** $uri = “[https://My](https://My) [Devinstance.okta.com/api/v1/users?limit=25](http://Devinstance.okta.com/api/v1/users?limit=25)” $userList = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers **Responce** Invoke-RestMethod : The remote server returned an error: (400) Bad Request. Any help would be appreciated. Thanks ---
**Author:** ![poul-okta](https://avatars.discourse-cdn.com/v4/letter/p/43a26b/32.png) [@poul-okta](https://devforum.okta.com/u/poul-okta)\ **Post date:** [September 19, 2023, 9:40pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/2 "2023-09-19T21:40:21Z")
Hello, The token being passed should be fine as it didn’t have a 401 or 403 response. Since this is a 400 response, it could indicate an issue with the headers being passed. I was able to get a 400 response on my org’s /users endpoint if the Content-Type or Accept header was set to a value other than application/json, such as text/plain. Are you seeing this issue if you include a content-type and accept header with the value application/json? Additionally, is the function that is making the GET call injecting any additional headers or content? ---
**Author:** ![rickroca66](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@rickroca66](https://devforum.okta.com/u/rickroca66)\ **Post date:** [September 20, 2023, 1:25pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/3 "2023-09-20T13:25:29Z")
Thank you poul-okta tha at least got the get to respond. After changing the header, I made the call and am now receiving a 403 Forbiden. I have made sure that the grant types are applied and I "Think the Scope is correct. Here is my ltest header creation. $headers = @{ “Accept” = “application/json” “Content-Type” = “application/x-www-form-urlencoded” “Authorization” = “Bearer $token” “cache-control” = “no-cache” } ---
**Author:** ![poul-okta](https://avatars.discourse-cdn.com/v4/letter/p/43a26b/32.png) [@poul-okta](https://devforum.okta.com/u/poul-okta)\ **Post date:** [September 20, 2023, 5:52pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/4 "2023-09-20T17:52:04Z")
Thanks for making that change, the headers should work properly. The 403 would mean that the proper authorization server is being used but it is missing a scope. For the GET call to the api/v1/users endpoint, it requires the okta.users.read scope. This will have to be granted on the Okta Application as well as in the /authorize call being made. You can determine if this is on the JWT itself by using [https://jwt.io](https://jwt.io) to decode the token and confirm this scope is listed in the scp claim. ---
**Author:** ![rickroca66](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@rickroca66](https://devforum.okta.com/u/rickroca66)\ **Post date:** [September 20, 2023, 6:42pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/5 "2023-09-20T18:42:00Z")
I have Decoded the Token and it Looks right. I am not sure exactly whay I am looking for. Below are the resuklts with a few Credential characters changed. What could be causing this. { “ver”: 1, “jti”: “AT.KZy3oRB4oDu4hHnZ6uI6QkiR8MF3ClAisEh1pbg”, “iss”: “[https://dev-86659676.okta.com/oauth2/default](https://dev-86659676.okta.com/oauth2/default)”, “aud”: “api://default”, “iat”: 1695220344, “exp”: 1695306744, “cid”: “0oab9qgml0t41Xf6I5d7”, “scp”: [ “test” ], “sub”: “0oab9qgml0t41Xf6I5d7”, “test”: “0oab9qgml0t41Xf6I5d7” } ![Outlook-signature_.png](https://global.discourse-cdn.com/oktadev/original/2X/b/bcbe0e61e6c20765672738094e0ac0c6f8a0a816.png) ![Outlook-signature_.png](https://global.discourse-cdn.com/oktadev/original/2X/0/0e552fd497304d6fa591ccaafcf767d6b02e33a0.png) ---
**Author:** ![poul-okta](https://avatars.discourse-cdn.com/v4/letter/p/43a26b/32.png) [@poul-okta](https://devforum.okta.com/u/poul-okta)\ **Post date:** [September 20, 2023, 7:03pm UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/6 "2023-09-20T19:03:57Z")
Thanks for providing the token, there are a couple issues that would be causing the 403 error. For the issuer (iss) claim, I’m seeing that this is being authenticated with the custom authorization server, however in order to use the Okta APIs, this does require using the org authorization server. The issuer for the org authorization server is [https://dev-86659676.okta.com](https://dev-86659676.okta.com). The endpoints for this authorization server can be found on the well-known endpoint at [https://dev-86659676.okta.com/.well-known/openid-configuration](https://dev-86659676.okta.com/.well-known/openid-configuration) Documentation regarding the two different types of authorization servers can be found at [Authorization servers | Okta Developer](https://developer.okta.com/docs/concepts/auth-servers/) Additionally, the scope needs to be okta.users.read. This is the scope that is required when making GET calls to the api/v1/users endpoint. This should be included in the /authorize request as well as granted within the application. When viewing the application in Okta, the Okta API scopes can be found on the Okta API Scopes tab. From here you can view which scopes are granted or not granted. By granting them, this means that when authenticating with the application, that scope is able to be included in the request. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 16, 2024, 12:42am UTC](https://devforum.okta.com/t/recieing-400-bad-request-when-using-bearer-token-auth/25350/7 "2024-02-16T00:42:07Z")