# \[HELP\] OIDC Authorization Code Flow - POST format

**URL:** <https://discuss.dev.twitch.com/t/help-oidc-authorization-code-flow-post-format/20641>\
**Category:** API\
**Created:** [March 23, 2019, 9:09am UTC](https://discuss.dev.twitch.com/t/help-oidc-authorization-code-flow-post-format/20641 "2019-03-23T09:09:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sweetsweetgwendoline](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/sweetsweetgwendoline/32/6017_2.png) [@sweetsweetgwendoline](https://discuss.dev.twitch.com/u/sweetsweetgwendoline)\
**Post date:** [March 23, 2019, 9:09am UTC](https://discuss.dev.twitch.com/t/help-oidc-authorization-code-flow-post-format/20641/1 "2019-03-23T09:09:59Z")

</div>

Hello I’m a little bit confused by the authorization process because I’ve never done OAuth before,  
and I’m new to web development.

I’m using C++ and plain (winsock) sockets.  
I was able to geht the OAuth 2.0 authorization code and now I’m stuck on step 3) of

> **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#oauth-authorization-code-flow)**
>
> Getting OAuth Access Tokens

The provided example just says:

```
POST https://id.twitch.tv/oauth2/token
?client_id=uo6dggojyb8d6soh92zknwmi5ej1q2
&client_secret=REMOVED
&code=REMOVED
&grant_type=authorization_code
&redirect_uri=http://localhost

```

My question is how do i need to send the request and how does it look like?  
I already tried several things like the following and nothing worked:

```
POST /oauth2/token HTTP/1.1

?client_id=uo6dggojyb8d6soh92zknwmi5ej1q2
&client_secret=REMOVED
&code=REMOVED
&grant_type=authorization_code
&redirect_uri=http://localhost

```

Do I need to add Conent-Type and Conent-Length or something else?  
Are new lines important? (“\r\n”)

Can someone please provide me a sample how this request should look like?

Or do i need to request with a SSL socket?

Thanks in advance

Gwen

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [March 23, 2019, 11:07am UTC](https://discuss.dev.twitch.com/t/help-oidc-authorization-code-flow-post-format/20641/2 "2019-03-23T11:07:45Z")

</div>

1. DO NOT POST YOUR `CLIENT SECRET` PUBLICLY. THIS IS AGAINST THE DEV TOS AND IT SHOULD BE TREATED AS A PASSWORD. I have edited your post accordingly. A `code` should be treated similar

2. You need to use whatever you want that supports sending a HTTP POST request over SSL in the language you are working in. So Yes SSL Socket.

Content-Type/length are headers and are not needed for this request. I don’t see any headers in the example, and they are not required

These may help

- cURL provides an example here: [https://curl.haxx.se/libcurl/c/https.html](https://curl.haxx.se/libcurl/c/https.html)
- [https://stackoverflow.com/questions/1011339/how-do-you-make-a-http-request-with-c](https://stackoverflow.com/questions/1011339/how-do-you-make-a-http-request-with-c)
- [https://social.msdn.microsoft.com/Forums/en-US/9a2bc7f1-7508-426f-9282-a01152176a7f/native-c-sample-using-ssl-https-and-winsock-for-oauth?forum=windowsmobiledev](https://social.msdn.microsoft.com/Forums/en-US/9a2bc7f1-7508-426f-9282-a01152176a7f/native-c-sample-using-ssl-https-and-winsock-for-oauth?forum=windowsmobiledev)
- [http://windowsmobilepro.blogspot.com/2006/03/windows-mobile-secure-socket\_25.html](http://windowsmobilepro.blogspot.com/2006/03/windows-mobile-secure-socket_25.html)

---

<div class="post-metadata">

**Author:** ![sweetsweetgwendoline](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/sweetsweetgwendoline/32/6017_2.png) [@sweetsweetgwendoline](https://discuss.dev.twitch.com/u/sweetsweetgwendoline)\
**Post date:** [March 23, 2019, 11:15am UTC](https://discuss.dev.twitch.com/t/help-oidc-authorization-code-flow-post-format/20641/3 "2019-03-23T11:15:28Z")

</div>

secret and code were from the doku example, not mine 😉  
and thanks so far 🙂

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [April 22, 2019, 11:15am UTC](https://discuss.dev.twitch.com/t/help-oidc-authorization-code-flow-post-format/20641/4 "2019-04-22T11:15:31Z")

</div>

Closed on April 22, 2019, 11:15am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.