0

I'm a bit of a newbie to using APIs, and in particular OAuth 2.0. I am trying to use Integromat to pull a financial report from the Xero API, but am stuck on trying to get the connection to work. This is the error I receive after selecting the organization I want to authenticate:

enter image description here

Here are the inputs I'm using in Integromat:

- Flow Type: Authorization Code

- Authorize URI: https://login.xero.com/identity/connect/authorize?response_type=code&client_id=MY_Client_ID&redirect_uri=https://www.integromat.com/oauth/cb/oauth2&scope=openid profile email accounting.reports.read&state=123

- Token URI: https://identity.xero.com/connect/token

- Client ID: My_Client_ID

- Client Secret: My_Client_Secret

Here is what my current setup looks like:

enter image description here

Addendum from original post:

When I click "Continue", I receive this screen:

enter image description here

When I click "Login" I come to this screen:

enter image description here

After selecting my organization from the dropdown and then clicking "Connect" I receive the aforementioned error.

Any help would be greatly appreciated.

battery514
  • 249
  • 6
  • 21

1 Answers1

0

Your setup looks ok - and you seem to understand messages, but it is not clear at what point the error occurs:

  • During the UI's login redirect, which gets an authorization code
  • During the authorization code grant, which swaps the code for tokens
  • During the API call, which should supply the OAuth 2.0 access token in the Authorization header

To troubleshoot I would use a tool such as Fiddler and view messages, as in my blog post. This often helps to identify malformed messages, and allows you to view full error details.

Gary Archer
  • 22,534
  • 2
  • 12
  • 24
  • Thanks for the help. To be honest, the blog post was a bit over my head. I added some more context and screenshots to my original post, so I am hoping that helps to identify the problem I am experiencing. My guess is the problem is with the token swap, but that's only a guess. – battery514 Jan 07 '20 at 15:52
  • I just meant that if you could capture the OAuth messages and post the one that's failing you'll get the best response – Gary Archer Jan 07 '20 at 18:19