Trouble Getting Refresh Token

[embkca]

Hello,

I'm having troubles getting the refresh token for my API integration. On the https://developers.hubspot.com/docs/api-reference/auth-oauth-v1/guide page, it says all I have to do is execute the curl script below, replacing the values provided in the sample with those specific to my application.

curl --request POST \
--url https://api.hubapi.com/oauth/v1/token \
--header 'content-type: application/x-www-form-urlencoded' \
--data 'grant_type=authorization_code&code=[code_here]&redirect_uri=https://www.domain.com/redirect&client_id=[clientID_here]&client_secret=[client_secret_here] '

When I replace the values and execute, I get the error response below. I am pretty sure the issue is with the code parameter.

{"status":"BAD_AUTH_CODE","message":"missing or unknown auth code","correlationId":"REMOVED"}

The documentation says:

After a user authorizes your app and installs it into their account, the redirect URL will be appended with a code value, which you can use to generate an access token and a refresh token. 

However, that isn't quite what happened. I got redirected to a page without a query string parameter. To get the code parameter, I had to open up the Chrome dev tools and snag it from the network activity log. I fear the code may not be the correct one i'm looking for.

Any guidance would appreciated.

[sylvain_tirreau · Accepted solution]

Hello @embkca,

You must follow this process:

• You have a script (install.py for example) whose URL you provide to your app in your Hubspot developer account;
• When the user installs your app, they will arrive at this URL after authorizing your app to be installed on your portal;
• It is in this installation URL to the install.py file that the code you must send back to Hubspot with the correct tokens will be inserted.

The code is still in this URL.

Are you following this procedure to retrieve the refresh and access tokens?

I do not recommend manually retrieving this code and then making a request with it. It is best to stay within the installation flow.

[BérangèreL]

Hi @embkca and welcome, we are delighted to have you here! 🤗

Thanks for your detailed post on the HubSpot Community!

The error {"status":"BAD_AUTH_CODE","message":"missing or unknown auth code"} typically means the authorization code is invalid or expired.
 

A few things to check:
 

- The code must be captured from the redirect URL immediately after user authorization; it’s only valid for a short time and can be used once.
- Make sure the redirect_uri in your token request matches exactly with the one used in your app’s authorization step.

For reference, here’s the official HubSpot OAuth guide: "Authentication overview".

This documentation can also be helpful: "Refresh an access token".

Also, I'd love to consult our Top Experts: Hi @sylvain_tirreau, @Anton and @Indra do you have other suggestions to help @embkca, please?

Have a wonderful weekend and thanks so much!
Bérangère