403 Error when using oath

[Fluxell (Adam Paeth)]

I’m in the process of migrating my application from using PATs to OATH client/secret. I’ve used the CLI to create the app including a redirect of http://localhost. The following is the URL that is being used with sensitive data removed

https://api.smartthings.com/oauth/authorize?client_id=6XXX&scope=r%3Adevices%3A%24%20x%3Adevices%3A*&response_type=code&redirect_uri=http%3A%2F%2Flocalhost

I always get the same 403 Forbidden error. I’ve tried a large number of variations on this to try and get it to work, but nothing seems to change

[TapioX]

@orangebucket created a post that you might find helpful.

SmartThings API Help

OK, let’s see what I can do using a Windows command line and a browser. The rest is fluff to start with. First we need to set up the ‘app’ at SmartThings end, which is easiest using the CLI because it walks you through it. At this stage don’t bother with a target URL. That only gets used if you are into subscriptions and things. The redirect URL comes into play in the next section. At this point you are whitelisting valid URLs that you can use, just as you are whitelisting scopes that you are allowed to select. > smartthing apps:create ? What kind of app do you want to create? (Currently, only OAuth-In apps are supported.) OAuth-In App More information on writing SmartApps can be found at https://developer.smartthings.com/docs/connected-services/smartapp-basics ? Display Name In sea…

[nayelyz (SmartThings Developer Support)]

Hi, @Fluxell

Did you solve the issue?
“HTTP” and “localhost” URLs are not accepted as Redirect URLs, so, you need to use an HTTPS URL that will redirect to your “localhost” endpoint. I suggest you use Ngrok to create a tunnel for this purpose.