# BAD\_CLIENT\_SECRET when refreshing OAuth2 token

**URL:** <https://community.hubspot.com/t/bad-client-secret-when-refreshing-oauth2-token/71659>\
**Category:** APIs & Integrations\
**Tags:** oauth\
**Created:** [December 21, 2022, 12:01pm UTC](https://community.hubspot.com/t/bad-client-secret-when-refreshing-oauth2-token/71659 "2022-12-21T12:01:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![caio-pizzol](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/caio-pizzol/32/33348_2.png) [@caio-pizzol](https://community.hubspot.com/u/caio-pizzol)\
**Post date:** [December 21, 2022, 12:01pm UTC](https://community.hubspot.com/t/bad-client-secret-when-refreshing-oauth2-token/71659/1 "2022-12-21T12:01:24Z")

</div>

Hey community!

I’m creating my second HubSpot App since I want to have 2 separated environment - test and prod.

(first HubSpot app just works fine - but I’m not able to do refresh the OAuth2 token with the 2nd App).

Here’s how I do it:

**1) Created a HubSpot app ([https://developer.hubspot.com/](https://developer.hubspot.com/))**

**2) Defined redirect URL in auth settings**

For example: [http://locahost](http://locahost)

**3) Installed your app with URL (through Browser)**

[https://app.hubspot.com/oauth/authorize?client\_id={client\_id}&redirect\_uri={redirect\_uri}&scope={scopes](https://app.hubspot.com/oauth/authorize?client_id=%7Bclient_id%7D&redirect_uri=%7Bredirect_uri%7D&scope=%7Bscopes)}

\> Within browser, selected which account the App should be installed to

**4) Retrieved the authorization code from URL**

[http://localhost/?code={code}](http://localhost/?code=%7Bcode%7D)

**5) Requested access token**

curl -i -X POST \

‘[https://api.hubapi.com/oauth/v1/token](https://api.hubapi.com/oauth/v1/token)’ \

-d ‘grant\_type=authorization\_code’ \

-d ‘client\_id={client\_id}’ \

-d ‘client\_secret={client\_secret}’ \

-d ‘redirect\_uri={redirect\_uri}’ \

-d ‘code={code}’

_ **Response:** _

{

“token\_type”:“bearer”,

“refresh\_token”:“{refresh\_token}”,

“access\_token”:“{access\_token}”,

“expires\_in”:1800

}

**6) Used the refresh token to generate a new access token (after expiring)**

curl -i -X POST \

‘[https://api.hubapi.com/oauth/v1/token](https://api.hubapi.com/oauth/v1/token)’ \

-H ‘Content-Type: application/x-www-form-urlencoded’ \

-d ‘grant\_type=refresh\_token’ \

-d ‘client\_id={client\_id}’ \

-d ‘client\_secret={client\_secret}’ \

-d ‘redirect\_uri={redirect\_uri}’ \

-d 'refresh\_token={refresh\_token}'​

**This is the response I got back:**

{

“status”: “BAD\_CLIENT\_SECRET”,

“message”: “missing or invalid client secret”,

“correlationId”: “63663eed-c495-4027-9714-22b511f56be5”

}

Any clue of what I might do doing wrong here?

(as I said for the 1st App it just works fine for me when refreshing the token)

---

<div class="post-metadata">

**Author:** ![TitiCuisset](https://avatars.discourse-cdn.com/v4/letter/t/8baadc/32.png) [@TitiCuisset](https://community.hubspot.com/u/TitiCuisset)\
**Post date:** [January 3, 2023, 1:29pm UTC](https://community.hubspot.com/t/bad-client-secret-when-refreshing-oauth2-token/71659/2 "2023-01-03T13:29:25Z")

</div>

Hi @caio-pizzol

Thank you for reaching out.

I want to tag some of our experts here - @Teun @coldrickjack @tominal do you have any thoughts for @caio-pizzol on this?

Thank you!

Best

Tiphaine

---

<div class="post-metadata">

**Author:** ![tominal](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/tominal/32/73018_2.png) [@tominal](https://community.hubspot.com/u/tominal)\
**Post date:** [January 4, 2023, 4:58pm UTC](https://community.hubspot.com/t/bad-client-secret-when-refreshing-oauth2-token/71659/3 "2023-01-04T16:58:47Z")

</div>

Hey @caio-pizzol,

I do not immediately see any issue here, but have you tried sending in your payload as JSON? Same result?

---

<div class="post-metadata">

**Author:** ![caio-pizzol](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/caio-pizzol/32/33348_2.png) [@caio-pizzol](https://community.hubspot.com/u/caio-pizzol)\
**Post date:** [January 4, 2023, 6:32pm UTC](https://community.hubspot.com/t/bad-client-secret-when-refreshing-oauth2-token/71659/4 "2023-01-04T18:32:43Z")

</div>

Hey guys,

Thanks a lot for the help.

I actually tried using the same mentioned steps and it suddenly worked.

It looks like on my first try - the **access\_token** wasn’t expired yet (after the 1800s) and that for some reason gave me the error.  
After the first expiration the _refresh\_token_ method works just fine (even when not waiting for the token expiration)