# HTTP Error 403 CORS origin denied getting access token **URL:** \ **Category:** API Q&A\ **Created:** [July 17, 2017, 6:28pm UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411 "2017-07-17T18:28:21Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![bradb](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/bradb/32/13_2.png) [@bradb](https://integration.keap.com/u/bradb)\ **Post date:** [July 20, 2017, 9:48pm UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/21 "2017-07-20T21:48:57Z")
Yeah, we already have created a ticket to update the docs. To be clear the spec does allow for accepting client credentials as `application/x-www-form-urlencoded` in the body but describes it as `MAY` not `MUST` so when I communicate to people I always steer them to the Basic Authorization header, especially when I read stuff like below. We use a 3rd party to handle our OAuth token processing so if there ever decide to change something I like to be conservative with the spec so we can hold them to it. Anyhow long winded apology for you are right 🙂 Glad everything is working now for you. If you run into anything else don’t hesitate to hit us up. > Including the client credentials in the request-body using the two > parameters is NOT RECOMMENDED and SHOULD be limited to clients unable > to directly utilize the HTTP Basic authentication scheme (or other > password-based HTTP authentication schemes). The parameters can only > be transmitted in the request-body and MUST NOT be included in the > request URI. ---
**Author:** ![Himanshu\_Phirke](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/himanshu_phirke/32/1267_2.png) [@Himanshu\_Phirke](https://integration.keap.com/u/Himanshu_Phirke)\ **Post date:** [July 26, 2017, 3:52pm UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/22 "2017-07-26T15:52:52Z")
I am trying to get Access token (from the code received via OAUTH). I am getting error: **‘{“error”:“invalid\_request”,“error\_description”:“response\_type or grant\_type is required”}’ } }** I have authentication header: Authorization: Basic + base64\_encode(CLIENT\_ID + ‘:’ + CLIENT\_SECRET) POST PARAMETERS redirect\_uri: [http://localhost:4321](http://localhost:4321) grant\_type: authorization\_code code: `` ` Content-Type: multipart/form-data; boundary=--------------------------490338410861714105830475` ---
**Author:** ![bradb](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/bradb/32/13_2.png) [@bradb](https://integration.keap.com/u/bradb)\ **Post date:** [July 26, 2017, 5:08pm UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/23 "2017-07-26T17:08:37Z")
`grant_type: code` should fix it. ---
**Author:** ![Himanshu\_Phirke](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/himanshu_phirke/32/1267_2.png) [@Himanshu\_Phirke](https://integration.keap.com/u/Himanshu_Phirke)\ **Post date:** [July 26, 2017, 5:23pm UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/24 "2017-07-26T17:23:28Z")
No it didn’t ---
**Author:** ![bradb](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/bradb/32/13_2.png) [@bradb](https://integration.keap.com/u/bradb)\ **Post date:** [July 26, 2017, 6:26pm UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/25 "2017-07-26T18:26:13Z")
Sorry I screwed up. Your original grant\_type was correct. I tried to answer on the run. The post should look like this. ```auto POST /token HTTP/1.1 Host: api.infusionsoft.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb ``` Make sure your client\_id and client\_secret are correct (If they work in the interactive REST docs then you should be good). Also make sure the `Content-Type` is `application/x-www-form-urlencoded`. The proivded auth header, code, and redirect\_uri are for example. Make sure your redirect\_uri is the same one you used to get the code. If you still can you give us the entire response including headers? ---
**Author:** ![Himanshu\_Phirke](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/himanshu_phirke/32/1267_2.png) [@Himanshu\_Phirke](https://integration.keap.com/u/Himanshu_Phirke)\ **Post date:** [July 27, 2017, 5:46am UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/26 "2017-07-27T05:46:53Z")
Actually I was using [request-promise](https://www.npmjs.com/package/request-promise) library to send the POST request. It said its using: > Content-Type: application/x-www-form-urlencoded , but it was not. I switched to basic https npm module from node it started working. Also, I am not sure if the InfusionSoft server is able to understand > Content-Type: multipart/form-data; with boundary. Thanks for your help. Please have the documentation updated. Its not that starightforward as it is documented. Example: Getting access token needs cleint\_id and secret in Auth header but documentation says it should be a param. Refresh token’s documentation is correct. ---
**Author:** ![bradb](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/bradb/32/13_2.png) [@bradb](https://integration.keap.com/u/bradb)\ **Post date:** [July 27, 2017, 5:50am UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/27 "2017-07-27T05:50:16Z")
@Himanshu_Phirke we are currently updating those docs and should be accurate on the next release. Unfortunately the /token endpoint is not an Infusionsoft server, it is our OAuth vendor Mashery. That is the main reason I urge everyone to stay as close to spec as possible, even if it works another way. Super happy you got it workin. Let us know if you need anything else. ---
**Author:** ![Himanshu\_Phirke](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/himanshu_phirke/32/1267_2.png) [@Himanshu\_Phirke](https://integration.keap.com/u/Himanshu_Phirke)\ **Post date:** [July 27, 2017, 5:57am UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/28 "2017-07-27T05:57:52Z")
Thanks for your help @bradb. My next job is to get tagged contacts via xml-rpc as REST does not support. So a quick question, can I use the access token of oauth for XM-rpc calls? The documentation says so, but if you could provide a feedback, would be helpful for me ---
**Author:** ![John\_Borelli](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/john_borelli/32/11880_2.png) [@John\_Borelli](https://integration.keap.com/u/John_Borelli)\ **Post date:** [July 27, 2017, 6:09am UTC](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411/29 "2017-07-27T06:09:16Z")
We use combined REST and API with the same token…yes absolutely. [Previous page](https://integration.keap.com/t/http-error-403-cors-origin-denied-getting-access-token/5411.md?page=1)