# OIDC Authorization - Bad Request - PHP

**URL:** <https://staging-discuss.dev.twitch.com/t/oidc-authorization-bad-request-php/14213>\
**Category:** API\
**Created:** [February 10, 2018, 7:53pm UTC](https://staging-discuss.dev.twitch.com/t/oidc-authorization-bad-request-php/14213 "2018-02-10T19:53:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![This\_Place](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/this_place/32/4122_2.png) [@This\_Place](https://staging-discuss.dev.twitch.com/u/This_Place)\
**Post date:** [February 10, 2018, 7:53pm UTC](https://staging-discuss.dev.twitch.com/t/oidc-authorization-bad-request-php/14213/1 "2018-02-10T19:53:02Z")

</div>

Following the information found here:

> **[Apps & Authentication](https://dev.twitch.tv/docs/authentication#oidc-authorization-code-flow-id-tokens-and-user-access-tokens)**
>
> Apps & Authentication

I am having some problems. I get the AUTH CODE without a problem. But then I go to post to the URL given:

`https://api.twitch.tv/api/oauth2/token`

This threw me a 404 so I figured the URL they meant was:

`https://api.twitch.tv/kraken/oauth2/token`

But following the flow is still giving me a 400 Bad Request error. Can someone help me know what I am doing wrong?

```
$url = 'https://api.twitch.tv/kraken/oauth2/token';	
$postdata = http_build_query(
	array(
		'client_id' => $cid,
		'client_secret' => $csec,
		'grant_type' => 'authorization_code',
		'redirect_uri' => $ruri,		
		'code' => $authCode								
	)
);

$opts = array('https' =>
	array(
		'method' => 'POST',
		'header' => 'Content-type: application/x-www-form-urlencoded',
		'content' => $postdata
	)
);

$context = stream_context_create($opts);
$data = file_get_contents($url,false,$context);
```

---

<div class="post-metadata">

**Author:** ![This\_Place](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/this_place/32/4122_2.png) [@This\_Place](https://staging-discuss.dev.twitch.com/u/This_Place)\
**Post date:** [February 10, 2018, 8:38pm UTC](https://staging-discuss.dev.twitch.com/t/oidc-authorization-bad-request-php/14213/2 "2018-02-10T20:38:36Z")

</div>

Was a stupid typo…

```
$opts = array('http' =>
	array(
		'method' => 'POST',
		'header' => 'Content-type: application/x-www-form-urlencoded',
		'content' => $postdata
	)
);
```

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [February 11, 2018, 11:05am UTC](https://staging-discuss.dev.twitch.com/t/oidc-authorization-bad-request-php/14213/3 "2018-02-11T11:05:32Z")

</div>

> [@This\_Place](#):
>
> $data = file\_get\_contents($url,false,$context);

Side note: you may want to change to using cURL here.

On _most_ production boxes file\_get\_contents cannot perform http requests.

Heres a rough cURL example

```
<?php

if ($_GET['code']) {
    $token_url = 'https://api.twitch.tv/api/oauth2/token';
    $data = array(
        'client_id' => $client_id,
        'client_secret' => $client_secret,
        'grant_type' => 'authorization_code',
        'redirect_uri' => $redirect_uri,
        'code' => $_GET['code']
    );

    $curl = curl_init($token_url);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

    $result = curl_exec($curl);
    $i = curl_getinfo($curl);
    curl_close($curl);

    if ($i['http_code'] == 200) {
        $result = json_decode($result, true);

    }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\
**Post date:** [March 13, 2018, 11:05am UTC](https://staging-discuss.dev.twitch.com/t/oidc-authorization-bad-request-php/14213/4 "2018-03-13T11:05:44Z")

</div>

Closed on March 13, 2018, 11:05am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.