# /Token bad request

**URL:** <https://devforum.okta.com/t/token-bad-request/9904>\
**Category:** Questions\
**Tags:** dotnet\
**Created:** [June 23, 2020, 4:53pm UTC](https://devforum.okta.com/t/token-bad-request/9904 "2020-06-23T16:53:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jelbatnigi](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jelbatnigi](https://devforum.okta.com/u/jelbatnigi)\
**Post date:** [June 23, 2020, 4:53pm UTC](https://devforum.okta.com/t/token-bad-request/9904/1 "2020-06-23T16:53:46Z")

</div>

I am trying to make a post call to get the token using /token API  
I am doing this using .net core.  
the call works when I do it using postman

here are the parameters I am passing

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/1/1d0e117b49c9218e73055c3f4311cf34277c8d2e.png)

Here are the headers I am passing

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/c/c509c0e739fffe038c63247608ad8513a0e4099f.png)

the authorization header is the client\_id and client\_Secret 64 encoded  
postman returns a token back

Now I am trying to do this programmatic in .net core. But I keep getting bad request. what am I doing wrong. here is the code making the call

```
public async Task InvokeAsync(HttpContext context)
        {

            if (context.Request.Path.Equals("/signin-oidc"))
            {
               var query = context.Request.Query["code"];
               using (HttpClient tokenClient = new HttpClient())
                {
                    string url = "https://{domain}.oktapreview.com/oauth2/afsfjru5uvj6eHSM9c0h7/v1/token";

                    var parameters = new Dictionary<string, string> { { "redirect_uri", _config.redirectUri }, { "code", query }, { "grant_type", "authorization_code" } };
                    var encodedContent = new FormUrlEncodedContent(parameters);

                    tokenClient.DefaultRequestHeaders.Add("Accept", "application/json");
                    string secretsEncoded = Base64Encode(_config.clientId + ":" + _config.clientSecret);
                    tokenClient.DefaultRequestHeaders.Add("authorization", "Basic " + secretsEncoded);

                    var task = tokenClient.PostAsync(url, encodedContent);
                    task.Wait();
                    var result = task.Result;
}
```

---

<div class="post-metadata">

**Author:** ![jelbatnigi](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jelbatnigi](https://devforum.okta.com/u/jelbatnigi)\
**Post date:** [June 25, 2020, 2:08am UTC](https://devforum.okta.com/t/token-bad-request/9904/2 "2020-06-25T02:08:26Z")

</div>

This is resolved  
with postman I have to provide the header Basic encoded64(client\_id:client\_secret)

when I do it from the code I need to include client\_id and client\_secret in the body without encoding

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 24, 2024, 8:10pm UTC](https://devforum.okta.com/t/token-bad-request/9904/3 "2024-01-24T20:10:21Z")

</div>

Closed on January 24, 2024, 8:10pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.