Getting "Missing authorization header" error with PHP POST CURL request - envato api
I am getting started with Enavato API
So far I have created an app, got client_id
and client_secret
and was able to get code
access_key from https://api.envato.com/authorization
after that, I am using the below php code to make curl POST request
$client_id = '***********';
$client_secret = '***********';
$redirect_uri = urlencode('http://localhost:3000');
if(isset($_GET["code"])) :
$apiUrl = 'https://api.envato.com/token';
$params = array(
'grant_type' => 'authorization_code',
'code' => $_GET["code"],
'redirect_uri' => $redirect_uri,
'client_id' => $client_id,
'client_secret' => $client_secret,
);
$curl = curl_init();
$f = fopen('request.txt', 'w');
curl_setopt($curl, CURLOPT_URL, $apiUrl);
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_VERBOSE, true);
curl_setopt($curl, CURLOPT_HEADER, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_POSTFIELDS, $params);
curl_setopt($curl, CURLOPT_STDERR, $f);
$result = curl_exec($curl);
fclose($f);
// Check if any error occurred
if(empty($result))
{
// die(curl_errno($curl));
// die(curl_error($curl));
$info = curl_getinfo($curl);
echo '<br><br>';
echo 'Took ' . $info['total_time'] . ' seconds to send a request to ' . $info['url'];
echo '<br><br>';
var_dump($info);
echo '<br><br>';
}
var_dump($result);
// Close handle
curl_close($curl);
endif;
and here is the request.txt
dump
* Hostname was found in DNS cache
* Hostname in DNS cache was stale, zapped
* Trying 107.23.230.180...
* Connected to api.envato.com (107.23.230.180) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* Server certificate: *.envato.com
* Server certificate: RapidSSL SHA256 CA - G3
* Server certificate: GeoTrust Global CA
> POST /token HTTP/1.1
Host: api.envato.com
Accept: */*
Content-Length: 699
Expect: 100-continue
Content-Type: multipart/form-data; boundary=------------------------1a95a06d7b815306
< HTTP/1.1 100 Continue
< HTTP/1.1 400 Bad Request
< Access-Control-Allow-Origin: *
< Cache-Control: no-store
< Content-Type: application/json; charset=utf-8
< Date: Sun, 17 May 2015 17:03:41 GMT
< Pragma: no-cache
* Server nginx/1.7.10 is not blacklisted
< Server: nginx/1.7.10
< set-cookie: connect.sid=s%3ARC9gGye-Txp4KLp67M9ESspXijYoUc8i.pT3jYHvu1WyOsSjwsuQzEsy5hLQlc2QpmHkZRm05pXo; Path=/; HttpOnly
< X-Frame-Options: Deny
< X-Powered-By: Express
< Content-Length: 80
< Connection: keep-alive
* HTTP error before end of send, stop sending
<
* Closing connection 0
and finally the error (getting it in JSON)
string (80) "{" error ":" invalid_request "," error_description ":" Missing authorization header "}"
Surprisingly every thing works with Postman and I get "refresh_token" and "access_token" with 200 success status code.
I know I missed something, but I couldn't find what?
source to share
You are using curl_setopt($curl, CURLOPT_POSTFIELDS, $params);
c $params
as an array. This results in an HTTP POST message with content type and formatting multipart/form-data
. But the spec says the content type should be application/x-www-form-urlencoded
. You can achieve this using:
curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params));
You also don't need a urlencode
parameter redirect_uri
, as it http_build_query
will do it for you.
Finally, do not disable SSL ( CURLOPT_SSL_VERIFYHOST
, CURLOPT_SSL_VERIFYPEER
) validation , as this makes your system insecure.
source to share