# Error: Invalid authorization code

**URL:** <https://community.auth0.com/t/error-invalid-authorization-code/134206>\
**Category:** Get Help\
**Tags:** login-experience, new-universal-login-experience\
**Created:** [May 15, 2024, 6:42pm UTC](https://community.auth0.com/t/error-invalid-authorization-code/134206 "2024-05-15T18:42:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gamcoh](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gamcoh/32/54204_2.png) [@gamcoh](https://community.auth0.com/u/gamcoh)\
**Post date:** [May 15, 2024, 6:42pm UTC](https://community.auth0.com/t/error-invalid-authorization-code/134206/1 "2024-05-15T18:42:50Z")

</div>

Hi,

I’m trying to create an application that could log in to another application using the implicit flow.  
So I have 2 apps, let’s say:

- Bankin’Pro
- TravelBudy

Bankin’Pro is the app that has the user infos and TravelBudy is the app where the user is trying to login using the button “Connect with Bankin’Pro”.

Here’s the code on TravelBudy:

```js
  const login = async () => {
    const auth0 = await createAuth0Client({
      domain: "bankinpro.eu.auth0.com",
      clientId: "xxx",
    });

    const res = await auth0.loginWithPopup({
      authorizationParams: {
        scope: "openid profile email",
        redirect_uri: "http://localhost:3000/",
        client_id: "<travel_budy_client_id>",
      },
    });
  };

```

The popup opens, I can login to the Bankin’Pro app, then I have the consent page where it asks if I want to share my Bankin’Pro data with TravelBudy, I consent, and then I got this error:

```json
{"error":"invalid_grant","error_description":"Invalid authorization code"}

```

Seems like it sends a POST request to this Bankin’sPro endpoint : [https://bankinpro.eu.auth0.com/oauth/token](https://bankinpro.eu.auth0.com/oauth/token)  
Error: Invalid authorization code

Do you guys have any idea what’s wrong?

---

<div class="post-metadata">

**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\
**Post date:** [May 21, 2024, 1:27pm UTC](https://community.auth0.com/t/error-invalid-authorization-code/134206/2 "2024-05-21T13:27:02Z")

</div>

Hi @gamcoh

Welcome to the Auth0 Community!

Thank you for posting your question! To secure your application best, I suggest switching to the Authorization Code Flow with PKCE. Regarding your current code, can you try including a response type in your request code?

```auto
 authorizationParams: {
            ...
            response_type: 'token' // Specify the response type for the implicit flow
        },

```

> **[OAuth2 Implicit Grant and SPA](https://auth0.com/blog/oauth2-implicit-grant-and-spa/)**
>
> Everything you always wanted to know (but were afraid to ask)

Thanks  
Dawid

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 4, 2024, 1:27pm UTC](https://community.auth0.com/t/error-invalid-authorization-code/134206/3 "2024-06-04T13:27:24Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.