# Swagger UI Browser requests to the token endpoint must use Proof Key for Code Exchange **URL:** \ **Category:** Questions\ **Created:** [August 17, 2021, 12:54am UTC](https://devforum.okta.com/t/swagger-ui-browser-requests-to-the-token-endpoint-must-use-proof-key-for-code-exchange/15544 "2021-08-17T00:54:58Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![srajgopal](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@srajgopal](https://devforum.okta.com/u/srajgopal)\ **Post date:** [August 17, 2021, 12:54am UTC](https://devforum.okta.com/t/swagger-ui-browser-requests-to-the-token-endpoint-must-use-proof-key-for-code-exchange/15544/1 "2021-08-17T00:54:58Z")
Using Swagger UI to access API endpoints. When the token endpoint is hit, it passes the following properly grant\_type code client\_id client\_secret redirect\_uri code\_verifier but still getting the error Auth ErrorError, error: invalid\_client, description: Browser requests to the token endpoint must use Proof Key for Code Exchange. A search resulted in this article which does not mention how to remove the origin header from being passed. [https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en\_US](https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en_US) ---
**Author:** ![Lijia](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/lijia/32/2295_2.png) [@Lijia](https://devforum.okta.com/u/Lijia)\ **Post date:** [August 17, 2021, 10:13pm UTC](https://devforum.okta.com/t/swagger-ui-browser-requests-to-the-token-endpoint-must-use-proof-key-for-code-exchange/15544/2 "2021-08-17T22:13:20Z")
@srajgopal I suggest you can test in desktop postman app as below: ![image](https://global.discourse-cdn.com/oktadev/original/2X/5/5208fbf7cc72eacc560aedfa988f190e348da1e5.png) It should work in this app. To setup the environment, you can refer the below doc. [https://developer.okta.com/code/rest/#set-up-your-environment](https://developer.okta.com/code/rest/#set-up-your-environment) To import the collections, please refer this doc. [https://developer.okta.com/docs/reference/postman-collections/](https://developer.okta.com/docs/reference/postman-collections/) ---
**Author:** ![maxb](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxb/32/3357_2.png) [@maxb](https://devforum.okta.com/u/maxb)\ **Post date:** [September 26, 2021, 10:26pm UTC](https://devforum.okta.com/t/swagger-ui-browser-requests-to-the-token-endpoint-must-use-proof-key-for-code-exchange/15544/3 "2021-09-26T22:26:22Z")
You must configure Okta with an app integration of “Single-Page Application” for it to support what Swagger UI is doing. ---
**Author:** ![MariusNor](https://avatars.discourse-cdn.com/v4/letter/m/e95f7d/32.png) [@MariusNor](https://devforum.okta.com/u/MariusNor)\ **Post date:** [February 25, 2022, 9:08pm UTC](https://devforum.okta.com/t/swagger-ui-browser-requests-to-the-token-endpoint-must-use-proof-key-for-code-exchange/15544/4 "2022-02-25T21:08:01Z")
The documentation is slightly misleading. For PKCE you must have the origin header. The catch is that you **must not send client\_secret**. Setting this field to “” or even removing this setting on swagger (depending what swagger library/implementation you are using) will solve the problem ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 8, 2024, 9:39pm UTC](https://devforum.okta.com/t/swagger-ui-browser-requests-to-the-token-endpoint-must-use-proof-key-for-code-exchange/15544/5 "2024-02-08T21:39:57Z")
Closed on February 8, 2024, 9:39pm UTC