During "Access Token Request", "code" obtained from "Authorization Request" immediately expires and returns status 400 with message: {"error":"invalid_grant","error_description":"The authorization code has expired"} #91
Description
I'm working through the instructions to obtain a TSheets OAuth2 token.
After successfully obtaining a code from an *authorization request (Step 1. Authorization Request) I'm redirected to the correct redirect_uri with the code (and state) param appended from the TSheets server.
After immediately (within 30 seconds) using the returned code value, for example S.19__10c14c11360ee25cae2826fdf21de49c38df9345 in a cURL request to request an Access Token (Step 2. Access Token Request) I get an access denied message:
{"error":"invalid_grant","error_description":"The authorization code has expired"}
Here's an example of the cURL request that is returning the 400:
curl -i -X POST https://rest.tsheets.com/api/v1/grant -d 'grant_type=authorization_code&client_id=**MY_KEY_VALUE**&client_secret=**MY_APP_SECRET_VALUE**&code=S.19__10c14c11360ee25cae2826fdf21de49c38df9345&redirect_uri=https%3A%2F%2Fdomain.com%2Fcallback%2Fpath%2Fhere'
Here's the cURL output:
HTTP/1.1 400 Bad Request
Date: Thu, 20 Oct 2022 03:20:57 GMT
Content-Type: application/json
Content-Length: 82
Server: Apache
Strict-Transport-Security: max-age=300; includeSubDomains
Cache-Control: private, must-revalidate
{"error":"invalid_grant","error_description":"The authorization code has expired"}
Am I missing something or is this a bug?
*My authorization request follows these instructions:
"This first step consists of a user authorizing your application to access their information on TSheets. To do this, you'll create a link somewhere on your site that they can use to initiate the process. The link will contain several parameters that are necessary for TSheets to consider it valid. The user should use a web browser to follow the link and perform the authorization request."