OAuth tutorial: Secure an API with Oauth does not work for me

[#1]

Hi everyone,

I'm totally noob in the use of apigee, and I'm trying to do the tutorials, but in the mentioned one I'm having the following error:

{"ErrorCode" : "invalid_client", "Error" :"Client identifier is required"}

when trying to make the following cURL call:

C:\Users\essanchezpa1>curl -X POST -H "Content-Type: application/x-www-form-urlencoded" https://fujitsu01-test.apigee.net/oauth/clie nt_credential/accesstoken?grant_type=client_credentials -d 'client_id%3DZeOgdVfmEhwOR9l7t2usqZJVWsb3A04w%26client_secret%3D7w8Lmx8gU hAS46qU'

I have urlencoded the data because if I try this call:

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" https://fujitsu01-test.apigee.net/oauth/client_credential/accesstoken?grant_type=client_credentials -d 'client_id=ZeOgdVfmEhwOR9l7t2usqZJVWsb3A04w&client_secret=7w8Lmx8gUhAS46qU'

Then, I get an additional error saying that "client_secret" is not recognized as an internal or external command, program or batch file. Seems like Windows thinks this is an incorrect command.

Please, can someone help me? I would appreciate some help, in order to understand what's going on.

Thanks in advance.

[DChiesa · Accepted solution]

I think the error like "client_secret" is not recognized as an internal or external command,

comes from the Windows cmd.exe executable. cmd.exe interprets the ampersand (&) as a special character that says "everything that follows this is another command". In your case that would be the string starting with "client_secret". You don't want that. The good news is you can quote ampersands (&) in commands to tell Windows "this is just an ampersand". To quote the ampersand in the cmd.exe shell, you can escape it with a caret (^). It looks like this:

curl -i -X POST -H "Content-Type: application/x-www-form-urlencoded" https://fujitsu01-test.apigee.net/oauth/client_credential/accesstoken?grant_type=client_credentials -d client_id=ZeOgdVfmEhwOR9l7t2usqZJVWsb3A04w^&client_secret=7w8Lmx8gUhAS46qU

This is a cmd.exe thing. Has nothing to do with curl. Or Apigee.

Alternatively you can quote the entire -d payload in double quotes rather than single quotes. This again is a technique particular to cmd.exe (and Windows).

Example:

curl -i -X POST -H "Content-Type: application/x-www-form-urlencoded" https://fujitsu01-test.apigee.net/oauth/client_credential/accesstoken?grant_type=client_credentials -d "client_id=ZeOgdVfmEhwOR9l7t2usqZJVWsb3A04w&client_secret=7w8Lmx8gUhAS46qU"

I just tested these commands and they both worked for me from my Windows machine.

You should use one technique (double quotes or caret) or the other; not both together.

[#3]

Hi @Dino,

Thank you very much. I tried with simple quotes because I thought it was the same effect as double quotes, but it seems it is not.

Kindly regards.