Parameter redirect_uri does not match registered URI

[siggi1970]

Hi guys,

maybe someone can help me out what I am doing wrong? I tried the authentification workflow as follows in php:

<?php
  define('AUTH_LOGINURL', 'https://api.twitch.tv/kraken/oauth2/authorize');
  define('AUTH_TOKENURL', 'https://api.twitch.tv/kraken/oauth2/token');
  define('AUTH_CLIENTID', 'myclientid');
  define('AUTH_REDIRECTURL', 'https://mydomain.com/auth/');
  define('AUTH_SCOPES', 'user_read');
  define('AUTH_SECRET', 'mysecret');
  
  if(isset($_GET['code'])) {
    $data = array(
      'client_id' => urlencode(AUTH_CLIENTID),
      'client_secret' => urlencode(AUTH_SECRET),
      'grant_type' => urlencode('authorization_code'),
      'redirect_uri' => urlencode(AUTH_REDIRECTURL),
      'code' => urlencode($_GET['code']),
      'state' => urlencode($_GET['state'])
    );
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, AUTH_TOKENURL);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt($ch,CURLOPT_POST, 1);
    curl_setopt($ch,CURLOPT_POSTFIELDS, $data);
    $result = curl_exec($ch);
    curl_close($ch);
    echo $result; 
  } else {
    echo '<a href="'.AUTH_LOGINURL.'?response_type=code&client_id='.urlencode(AUTH_CLIENTID).'&redirect_uri='.urlencode(AUTH_REDIRECTURL).'&scope='.AUTH_SCOPES.'&state='.time().'"><img src="connect_dark.png"/></a>';
  }

?>

Each time i am trying this, i got the following result:

My browser gets refreshed to following url:

https://mydomain.com/auth/?code=thecode&scope=user_read&state=1461690138

but the output from the echo while fetching the access token is still:

{"error":"Bad Request","status":400,"message":"Parameter redirect_uri does not match registered URI"}

Why does that happen?

[BarryCarlyon]

Did you set the redirect_uri to https://mydomain.com/auth/ in the Application Settings on Twitch?

[siggi1970]

Found the issue… The POST parameters should NOT be urlencoded as it is mentioned in the API doc.

[3ventic]

CURLOPT_POSTFIELDS does the urlencoding for you if you pass the data as an array, so you were in fact double-encoding it.