# Resource Owner Password flow responds with 500

**URL:** <https://community.auth0.com/t/resource-owner-password-flow-responds-with-500/86773>\
**Category:** Get Help\
**Tags:** resource-owner-passw\
**Created:** [July 11, 2022, 6:57pm UTC](https://community.auth0.com/t/resource-owner-password-flow-responds-with-500/86773 "2022-07-11T18:57:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![michael-bamboo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/michael-bamboo/32/37764_2.png) [@michael-bamboo](https://community.auth0.com/u/michael-bamboo)\
**Post date:** [July 11, 2022, 6:57pm UTC](https://community.auth0.com/t/resource-owner-password-flow-responds-with-500/86773/1 "2022-07-11T18:57:01Z")

</div>

## Problem

I’m trying to get an access token for a given user via Resource Owner Password flow, but my request to `https://MY-APPS-DOMAIN/oauth/token` keeps failing with a generic 500 status code.

## Rough Setup

- Application (“App”) setup as _machine-to-machine_ with Token Endpoint Auth Method set to `POST`
- API (“API”) setup and authorized for “App”
- User created

## Code Sample (.NET)

In code, I’m attempting to call the token endpoint using the Resource Owner Password grant type, but I keep getting a 500. Here’s a sample of what I’m doing:

```auto
var body = new Dictionary<string, string>
{
    {"client_id", <client ID of App>},
    {"client_secret", <client secret of App>},
    {"audience", <Identifier of API>},
    {"grant_type", "password"},
    {"username", <username of a created user>},
    {"password", <password of a created user>},
}

var requestContent = new FormUrlEncodedContent(body);
var response = await httpClient.PostAsync("https://MY-APP-DOMAIN/oauth/token", requestContent);

// response.StatusCode == 500

```

Is this flow not possible with a Machine-to-Machine app? Am I missing something else, somewhere… somehow?

## Edit

I’ve also confirmed that the given user info works via the _Try Connection_ tab for my Authentication Connection.

---

<div class="post-metadata">

**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\
**Post date:** [July 11, 2022, 7:48pm UTC](https://community.auth0.com/t/resource-owner-password-flow-responds-with-500/86773/3 "2022-07-11T19:48:15Z")

</div>

Hi @michael-bamboo ,

Thank you for posting this topic on the Auth0 Community!

`Is this flow not possible with a Machine-to-Machine app? Am I missing something else, somewhere… somehow?`

In [this](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow#how-it-works) ROPG documentation, the steps are for the Regular Web App instead of the Machine-to-Machine app. For the M2M application, Auth0 uses the [Client Credential flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow), that is, it authenticates and authorizes the app rather than a user.

Here are the scripts:

```auto
curl --request POST \
  --url 'https://YOUR_DOMAIN/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data audience=YOUR_API_IDENTIFIER

```

Hope this helps!

---

<div class="post-metadata">

**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\
**Post date:** [July 28, 2022, 3:00pm UTC](https://community.auth0.com/t/resource-owner-password-flow-responds-with-500/86773/4 "2022-07-28T15:00:31Z")

</div>

This topic was automatically closed after 18 hours. New replies are no longer allowed.