Spotify API demanding a parameter that is not required

Question

I know this is a particular issue that I'm having but I'm struggling with it for ages...If anyone could give me a hint on how to proceed It would be great.

I'm trying to integrate my flutter app to Spotify API and according to Spotify docs, after the user accepted the conditions at their site, it would be redirected back with a code - In my application I'm already retrieving this code. After that, I need to make a request for another endpoint to "trade" my code for an auth.

The docs demand a POST with 3 parameters(grant_type,redirect_uri and code). But even though I send all of this informations I get a (400 -Bad Request) with the description:

{"error":"invalid_request","error_description":"code_verifier required"}

But note that code_verifier is only required for a PKCE request, as far as I understand.

My post method is the following:

Future getUserAccessToken(String authorizationCode) async {
// Get the Access Token in exchange for the Authorization Code
var url = 'https://accounts.spotify.com/api/token';
var body = {
  'grant_type': 'authorization_code',
  'code': authorizationCode,
  'redirect_uri': redirectUrl,
};
var response = await post(Uri.parse(url), body: body, headers: {
  'Content-Type': "application/x-www-form-urlencoded",
  'Authorization':
         'Basic ${base64Encode(utf8.encode('$clientID:$clientSecret'))}',
});
}

They also demand this at the authorization header:

Base 64 encoded string that contains the client ID and client secret key. The field must have the format: Authorization: Basic

Answer 1

I would recommend going forward with PKCE. It will protect your app against CSRF and authorization code injection attacks. It's also not too bad to implement.

All you should have to do is:

1. Generate a random string using the characters A-Z, a-z, 0-9, and the punctuation characters -._~ (hyphen, period, underscore, and tilde), between 43 and 128 characters long. This is your code_verifier
2. Hash that string with SHA256. This is your code_challenge.
3. Send those values in the requests as the documentation indicates, which means base64 url encoding them, as well. The Spotify doc says "The body of this POST request must contain the following parameters encoded in application/x-www-form-urlencoded".

Also, in case you haven't seen it, there's a OAuth flow example implemented in JS here: https://github.com/spotify/web-api-auth-examples/blob/master/authorization_code/app.js Their copy of this portion looks like:

    var authOptions = {
      url: 'https://accounts.spotify.com/api/token',
      form: {
        code: code,
        redirect_uri: redirect_uri,
        grant_type: 'authorization_code'
      },
      headers: {
        'Authorization': 'Basic ' + (new Buffer(client_id + ':' + client_secret).toString('base64'))
      },
      json: true
    };

    request.post(authOptions, function(error, response, body) {...})

The example has "request": "~2.83.0" in the package.json.

Notice how they use form which I would assume is base 64 url encoding the body, as the docs indicate. Not sure how the post method you're using with dart/flutter works with respect to base 64 url encoding, so that's something to investigate, as well.

Credit to https://www.oauth.com/oauth2-servers/pkce/authorization-request/ for providing some of the text in this response