# { status: 400, message: 'Invalid authorization code' } **URL:** \ **Category:** API\ **Created:** [January 19, 2023, 9:09pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908 "2023-01-19T21:09:03Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Guendi](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Guendi](https://discuss.dev.twitch.com/u/Guendi)\ **Post date:** [January 19, 2023, 9:09pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/1 "2023-01-19T21:09:03Z")
I’m building my project completly new from php to js. I copied the same code but I always got { status: 400, message: ‘Invalid authorization code’ } url: [https://id.twitch.tv/oauth2/token?client\_id=\*\*(replaced)\*\*&client\_secret=\*\*(replaced)\*\*d&redirect\_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Ftwitch&grant\_type=authorization\_code&code=n61ps7fvucwkfu708vpam6nb6xtozt](https://id.twitch.tv/oauth2/token?client_id=**(replaced)**&client_secret=**(replaced)**d&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Ftwitch&grant_type=authorization_code&code=n61ps7fvucwkfu708vpam6nb6xtozt) I dont know what the problem is ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 19, 2023, 9:13pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/2 "2023-01-19T21:13:34Z")
The code is already used is a common problem here. As the `code` is a one use code to be exchanged for a token The `code` should be dynamically obtained from the URL as it’s a query strin parameter and not hard coded. ---
**Author:** ![Guendi](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Guendi](https://discuss.dev.twitch.com/u/Guendi)\ **Post date:** [January 19, 2023, 9:15pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/3 "2023-01-19T21:15:13Z")
that was the response from oauth2/authorize { code: ‘n61ps7fvucwkfu708vpam6nb6xtozt’, scope: ‘user:read:email’, state: ‘qbf17d9ernqbf17d9ern’ } I used the code from response ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 19, 2023, 9:49pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/4 "2023-01-19T21:49:07Z")
Then you have either - not used the `code` in time, they have about 5 minutes to live - you have already used the `code` to exchange for a token, they are one use ---
**Author:** ![Guendi](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Guendi](https://discuss.dev.twitch.com/u/Guendi)\ **Post date:** [January 19, 2023, 9:59pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/5 "2023-01-19T21:59:29Z")
both options are not possible. I try to get the access-token immediately ![image](https://d2opxh93rbxzdn.cloudfront.net/original/3X/7/c/7c31572f2f7cce5542cb28bd2e328e6ba942fa6b.png) ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 19, 2023, 10:00pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/6 "2023-01-19T22:00:35Z")
Then this suggests a fault in `twitchClass.getTwitchAccessToken` Would need to see what that function is doing. ---
**Author:** ![Guendi](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Guendi](https://discuss.dev.twitch.com/u/Guendi)\ **Post date:** [January 19, 2023, 10:01pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/7 "2023-01-19T22:01:32Z")
![image](https://d2opxh93rbxzdn.cloudfront.net/original/3X/4/5/4521137169029480b5ce53da2f4e9099e15a42bf.png) ![image](https://d2opxh93rbxzdn.cloudfront.net/original/3X/a/b/abe2c042f133dd8c14da766a0b26bd0711d72bb0.png) ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 19, 2023, 10:33pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/8 "2023-01-19T22:33:19Z")
Broadly looks correct. What does `queryBuilder` do? Heres a simplier fetch example to reference > ---
**Author:** ![Guendi](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Guendi](https://discuss.dev.twitch.com/u/Guendi)\ **Post date:** [January 19, 2023, 11:03pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/9 "2023-01-19T23:03:31Z")
![image](https://d2opxh93rbxzdn.cloudfront.net/original/3X/f/6/f615e6f1a1b02b243f350fd33043f949a1b80a24.png) I tried it with your method and it worked. THANKS! 👍 ---
**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\ **Post date:** [February 18, 2023, 11:03pm UTC](https://discuss.dev.twitch.com/t/status-400-message-invalid-authorization-code/42908/10 "2023-02-18T23:03:45Z")
Closed on February 18, 2023, 11:03pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.