# Invalid authorization code- Rails

**URL:** <https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414>\
**Category:** API\
**Created:** [January 7, 2015, 3:19pm UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414 "2015-01-07T15:19:50Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Techonup](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@Techonup](https://discuss.dev.twitch.com/u/Techonup)\
**Post date:** [January 7, 2015, 3:19pm UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/1 "2015-01-07T15:19:50Z")

</div>

Hello,

I’m currently building a Rails application with [this Twitch gem](https://github.com/dustinlakin/twitch-rb). When I attempt to log in, I am correctly redirected to Twitch and back to my redirect URI, but attempting to get an access token with the provided auth code always fails.

Here’s the code on my redirect\_uri (identical to the example provided in the gem’s README):

```
@twitch = Twitch.new({
  :client_id => CLIENT_ID,
  :secret_key => SECRET_KEY,
  :redirect_uri => REDIRECT_URI
})

@data = @twitch.auth(params[:code])
session[:access_token] = @data[:body]["access_token"]

```

As a quick side note, here are the relevant lines from the twitch gem:

```
def initialize(options = {})
	@client_id = options[:client_id] || nil
	@secret_key = options[:secret_key] || nil
	@redirect_uri = options[:redirect_uri] || nil
	@scope = options[:scope] || nil
	@access_token = options[:access_token] || nil

	@base_url = "https://api.twitch.tv/kraken"
end

def auth(code)
	path = "/oauth2/token"
	url = @base_url + path
	post(url, {
		:client_id => @client_id,
		:client_secret => @secret_key,
		:grant_type => "authorization_code",
		:redirect_uri => @redirect_uri,
		:code => code
	})
end

```

The parameters passed to my redirect\_uri (auth code has been modified for privacy):

```
{"code"=>"rfyyvhb4jvcbd3t6wrcn12v24ybnzl6", "scope"=>"user_read"}

```

The API always responds with:

```
{:body=>{"error"=>"Bad Request", "status"=>400, "message"=>"Invalid authorization code"}, :response=>400}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![Techonup](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@Techonup](https://discuss.dev.twitch.com/u/Techonup)\
**Post date:** [January 9, 2015, 2:14pm UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/2 "2015-01-09T14:14:32Z")

</div>

Did a quick check of the POST request for the token by sending it to RequestBin- all parameters appear correct.

---

<div class="post-metadata">

**Author:** ![Techonup](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@Techonup](https://discuss.dev.twitch.com/u/Techonup)\
**Post date:** [January 14, 2015, 2:50pm UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/3 "2015-01-14T14:50:43Z")

</div>

At this point I’m pretty lost- as far as I can tell, I’m sending a properly formatted POST request to [https://api.twitch.tv/kraken/oauth2/token](https://api.twitch.tv/kraken/oauth2/token). The API says that the auth code is wrong, but inspecting the request I send, the code is exactly identical to the one I receive immediately beforehand. Any tips on what might be the issue here?

---

<div class="post-metadata">

**Author:** ![Fugiman](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/fugiman/32/108_2.png) [@Fugiman](https://discuss.dev.twitch.com/u/Fugiman)\
**Post date:** [January 15, 2015, 1:02am UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/4 "2015-01-15T01:02:53Z")

</div>

Hmm, the only reason you should get that error (assuming the login flow is all correct) is due to trying to re-use an auth token. What is your client\_id, and what user were you trying to login with?

---

<div class="post-metadata">

**Author:** ![Techonup](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@Techonup](https://discuss.dev.twitch.com/u/Techonup)\
**Post date:** [January 15, 2015, 2:09am UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/5 "2015-01-15T02:09:10Z")

</div>

client\_id: flz2nj3mgm3ln8w7h40bexemyug33d8  
Logging in with Twitch user isspkmn

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![Fugiman](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/fugiman/32/108_2.png) [@Fugiman](https://discuss.dev.twitch.com/u/Fugiman)\
**Post date:** [January 15, 2015, 3:15am UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/6 "2015-01-15T03:15:24Z")

</div>

From our logs it seems like you are requesting the token twice. The first time succeeds, the second time fails as we invalidate the auth code after it’s first use.

---

<div class="post-metadata">

**Author:** ![Techonup](https://avatars.discourse-cdn.com/v4/letter/t/d9b06d/32.png) [@Techonup](https://discuss.dev.twitch.com/u/Techonup)\
**Post date:** [January 15, 2015, 2:19pm UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/7 "2015-01-15T14:19:59Z")

</div>

Found the bug on my end- the gem was making two POST calls. Thanks again, Fugiman.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [January 25, 2015, 2:20pm UTC](https://discuss.dev.twitch.com/t/invalid-authorization-code-rails/1414/8 "2015-01-25T14:20:22Z")

</div>

Closed on January 25, 2015, 2:20pm UTC

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.