node.js - Api call works with token acquired from Postman, but not from the token acquired via nodejs app

Question

So I am trying to do an API call to a third party API provider. There is no problem receiving new tokens in my nodejs app, but when I'm trying to use it in a get function I only get a 403 error. However if I acquire the token via Postman it works just fine (in the app), which seems very strange to me?

It's the same if I try using a token acquired from the nodejs app in a get call in Postman, it wont work.

I've checked numerous times for any errors with the token acquired from my nodejs app, but cannot fathom why it does not work. I use firebase to store it, and it gets updated every time with no issues.

Code for getting and storing token looks like this:

const response = await axios.request(options)
      let token = response.data.access_token
      console.log(token) // receiving a new token every time, no issues
      db.doc(`/company1/tokens`).update(tokenObj = { token: token }).then(
        console.log("lagring ferdig")
      )

Code for the api call looks like this:

let doc = await db.collection(`/company1`).doc("tokens").get()

    let data = doc.data()
    //console.log(data.token) 

    const request = await fetch(`https://xxxxx/api/v2/company`, {
      method: 'GET',
      headers: {
        Authorization: `Bearer ${data.token}`, 
        'Content-Type': 'application/json'
      }
    })

So to clarify: If I simply paste a token acquired via Postman in the firestore doc it works just fine.

Any idea as to what can cause this? Any help is much appreciated.

question from:https://stackoverflow.com/questions/66052671/api-call-works-with-token-acquired-from-postman-but-not-from-the-token-acquired

Answer 1

So turns out there was an issue with the setup of scopes, when I changed to appending them to the url it worked. Good tip from "arynaq" using jwt.io for token troubleshooting.

 url: 'https:/xxxxxx/oauth/token?openid%20email%20profile%20read:findata%20create:findata',
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      data: {
        grant_type: 'password',
        username: process.env.UNAME,
        password: process.env.PW,
        audience: 'https://xxxxxxxxx.no',
        //scope: 'openid%20email%20profile%20read:findata%20create:findata', <-- this did not work
        client_id: process.env.CID,
        client_secret: process.env.CS
      }