redirect_uri doesn't match the client registered redirect_uri

[S2-StvSimons]

I have an app that has been in use for several years using OAuth, and haven't since last year tried connecting to a different HubSpot target account. Now when I do I get this 'redirect_uri doesn't match' error.

App is built using the hubspot/hubspot-php version 4.0.2 library, and I'm using the connection method described in the ReadME with the Factory method:

// Build URL for OAuth

$authUrl = \SevenShores\Hubspot\Utils\OAuth2::getAuthUrl(

  $this->client_id,

  $this->redirect_uri,

  $this->client_scope_array,

  []

);

header('Location: ' . $authUrl);

Then in the HS Dev panel for the app, previously there was no Redirect_URI entered, but it looks like that is now a requirement. So at first I was trying with my dev system which I was using a simple http://localhost/application/ URL and was still receiving the same error. Thought perhaps I needed to setup a self-signed name and SSL as that's now required for anything other than 'localhost', set that up (ssl/site application.localdev) and tried that for a redirect_uri,  but that didn't make any difference, same error.

There are two differences in the HS documentation Auth URL samples redirect_uri values and mine (other than the destination).

(mine)

https://app.hubspot.com/oauth/#####/authorize?client_id=abcdf####&redirect_uri=https%3A%2F%2Fapplication.localdev%3Faction%3Doauth-callback&scope=crm.lists.read%20crm.lists.write ...

(HS typical example)

https://app.hubspot.com/oauth/authorize?client_id=abcdf####&redirect_uri=https://www.example.com/auth-callback&scope= ...

First is the encoding the HubSpot-PHP library is encoding (correctly I believe) the '://', '?', and '=' in my redirect_uri ('https%3A%2F%2Fapplication.localdev%3F..'.) where as the examples only escape the spaces in the 'scope' value  (examples are 'https://www.example...'). There is a 5x version of hubspot-php, looking that the static method for generating the Auth URL while improved (it doesn't add empty optional query string keys) uses the same encoding so 'redirect_url=https://anything' will still be passed as 'redirect_url=https%3A%2F%2Fanything' in the auth url.

Second difference is my callback redirect_uri includes a query string.

In the HubSpot dev control panel Auth screen, are redirect_uri's to include the query string? Assume it does but tried with and without, and with and without trailing slashes (note "https://" is displayed before the entry field, so assume that's to mean not include in the input entry):

https:// "application.localdev"

https:// "application.localdev/"

https:// "application.localdev/?action=auth-callback"

https:// "application.localdev?action=auth-callback"

https:// "localhost/application"

https:// "localhost/application/"

https:// "localhost/application/action=auth-callback"

and still get the error after selecting an account to connect: redirect_uri doesn't match the client registered redirect_uri.

1. What might I be missing?
2. Am I at least correct the message 'redirect_uri doesn't match client regirstered redirect_uri' to mean the passed redirect_uri value in the Auth URL is not being found in the list of redirect_uri's in the app's Auth screen?
3. The listed redirect_uri in the Auth screen need to be exact path AND query string to match what will be passed in the Auth URL redirect_uri value?
4. Should not the redirect_url value in the auth url encoding to be 'encodeURICompontent' equivalent ("http%3A%2F%2Fwww.example...")?

[Jaycee_Lewis]

Hi, @S2-StvSimons 👋 Thank you for providing such a detailed post. It sounds like you are on the right track.

I have a few, maybe basic, questions to help get us started, and I'll tag a few of PHP-using community members in to give their insight as well, where possible.

• The redirect_uri used in your code should be identical to the one in the HubSpot app settings, including trailing slashes and query parameters

• URL encoding should be identical between the code and the app settings

• As a last resort, you could try resetting the client secret and updating it in your code to ensure there's no issue with the client credentials

If possible, could you please share the exact redirect_uri you've registered on the HubSpot app settings and what redirect_uri you're specifying in the code (without any sensitive information)? That will help the community troubleshoot this issue more effectively.

Thank you! — Jaycee

[S2-StvSimons · Accepted solution]

Thank you Jaycee. My exact redirect_url that I eventually got to work was 'mdd-integrator.localdev/?action=oauth-callback'. I ended up removing all the redirect urls in the Auth area, and started by entering only the one I thought it should be. It then got me past the error.

I then played and set my dev site back to work using a localhost url - as was before all this started. I'm not sure why but for both 'http://' (as original) and 'https://localhost/mdd-integrator/?action=oauth-callback', trying with the redirect urls first with none and then to 'localhost/mdd-integrator/?action=oauth-callback', I always got the 'redirect_uri doesn't match ...' error. Doesn't seem to like 'localhost'. Not a big deal since I've setup a dev domain/ssl now so I switched back to that. I'd think/hope anything with 'localhost' as a doman the HS code would be super flexible granting access - the secret and user permissions would keep things secure.

The other thing I experemented before resetting all the redirect_urls is the encoding. Seems not to make a difference. The way hubspot-php lib encodes the redirect_uri all non-alphanumeric characters are converted to % equiv codes. I messed around modifing that so the '://' wasn't altered, didn't make a difference, so I'm guessing fully encoded or minimally encoded the HubSpot code is decoding either before comparing, so passing 'redirect_uri=http%3A%2F%2F...' or 'redirect_uri=http://...' both should work.

Last experiment was adding in the live app's redirect_url, testing it worked and the localdev site also continued to work even through the 'redirect_uri' listed in the Install URL was to the live site. Seems ideally that should be displayed in the Redirect URLs area, one per entered URL.

Anyway, I'm back to running again, though can't pin exactly why deleting all the listed Redirect_Urls and adding back worked. Perhaps a special character or space got in the input control and wasn't trimed in the redirect_url's list, not sure.

Thank you for the reply!

[Jaycee_Lewis]

Hey hey @S2-StvSimons 👋 Thank YOU for taking the time to follow up.

I hope you have a smashingly good weekend! — Jaycee