SPA Application get access token with code and PKCE got 403 response

Questions
#1

I added a SPA application in my sandbox.

As below are steps I tried to retrieve access token:

  1. Primary auth to get a sessionToken and I can get sessionToken successfully
    a. POST to {{url}}/api/v1/authn
    b. Post body:
    {
    “username”: “{{username}}”,
    “password”: “{{password}}”,
    “options”: {
    “multiOptionalFactorEnroll”: false,
    “warnBeforePasswordExpired”: false
    }
    }
  2. Get CODE by using sessionToken from step 1: {{url}}/oauth2/v1/authorize?client_id={{clientId}}&response_type=code&response_mode=query&scope={{scopes}}&redirect_uri={{redirectUri}}&state=testSTATE1&nonce={{$guid}}&sessionToken={{sessionToken}}&code_challenge=SkNfsVeQqEkR-yFPANbPIHIdzZRbJVMy9KP6idjLtPo&code_challenge_method=S256
  3. Get ID Token with Code and PKCE. And I got 403 response at this stage
    a. POST to {{url}}/oauth2/v1/token
    b. Request header:
    Accept: application/json
    User-Agent: PostmanRuntime/7.24.1
    Cache-Control: no-cache
    Postman-Token: 683e95d3-9fca-43b8-a8b4-073ab6ad70b0
    Host: dev-183482.okta.com
    Accept-Encoding: gzip, deflate, br
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 294
    Cookie: t=default; DT=DI0P0baP1OQTe-N9iX2LgaIpw; proximity_5c040d49b336c83244cceef329fba387=6BR79x3gGpN7tSI9YDcIIWUHa8Fe0jqz/+2xHuJqGZ9AprRZZ3KV/t00sgZOHdz3tKqQBfHjH8pOEwH5R/IK6bSuLJOm/bFa0ByYRUZQu1UcPyMO7eeM4H16fcfNN9spnfXJRqP5+donbL0JoEo+9hsrNeStTtCt3MeS7OdoAG9dbqzoG+F2t0ObnD1ShZM4; JSESSIONID=5BE5A7B29F68ECB143E26902D529D8C2; sid=102ZhtzfcTIS_G24M9CG_yEmg

c. Request body:
grant_type: “authorization_code”
client_id: “0oacnnw02Z22ZsxUT4x6”
redirect_uri: “http://localhost:8080/implicit/callback”
code: “8EMzAtFbuJFtBJwPKVWv”
code_verifier: “4EE_utEnDfyPnbyaVmGT6Jw.1SDupKnS6FeFozdV2E7HC8sdRWiXp~PsXoiRK4w5jHQsaxPRtjkWlL_AhOBRRstqCjAx9n1F4o~a-sWhsbUmgrBHjaYBKhkOrGRB5.xC”

Anyone could help?

#2

Are you making these calls manually? What framework are you using? Our SDKs might be able to make this a lot easier for you. In the meantime, this blog post might help.

#3

Quoting @andreaskouras from a previous question

Please clear your cookies and try again. It should work.

#4

Thanks guys! Clearing cookie did the magic.

1 Like