Resource Owner Password flow only works with headers removed

Get Help
, ,
3

Hi @peter22,

Welcome to the Auth0 Community!

I understand that you encountered issues when making a Resource Owner Password Grant (ROPG) flow request.

I have seen this issue in the past, and it involves fixing the content-type in the request to application/json.

See below:

var axios = require("axios").default;

var options = {
  method: 'POST',
  url: 'https://YOUR_DOMAIN.REGION.auth0.com/oauth/token',
  headers: {'content-type': 'application/json'},
  data: {    
    grant_type: "password",
    username: "user@example.com",
    password: "pwd",
    audience: 'YOUR_AUDIENCE_IDENTIFIER',
    scope:  'read:sample',
    client_id: "YOUR_CLIENT_ID",
    client_secret: "YOUR_CLIENT_SECRET"

  }
};

axios.request(options).then(function (response) {
  console.log(response.data);
}).catch(function (error) {
  console.error(error);
});

Let me explain further. When using the "application/x-www-form-urlencoded" content-type as shown in our documentation, the data gets passed as URL encoded. Meaning that the data is appended to the URL, like below:

grant_type=password&username=user@example.com&password=pwd&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_AUDIENCE&scope=read:sample

Whereas the "application/json" content type is used for POSTing JSON data.

Hoped this helps!

Please let me know if you have any additional questions.

Thank you.

1 Like