404 error=invalid_request&error_description=The+request+is+malformed

[rst11]

Hi, I am implementing the oauth2 part of my smartapp and the authorize step directs to error=invalid_request&error_description=The+request+is+malformed.

I am directing user to
https://api.smartthings.com/oauth/authorize?response_type=code&client_id=3446d2fc-7541-4758-ad03-e781bb8fb82&redirect_url=https://www.MYDOMAIN.co.uk:5000/callback

as a user I am able to login, select the location and devices and click the authorize button.
This directs to the https://api.smartthings.com/installedapp?error=invalid_request&error_description=The+request+is+malformed. url and a 404 error.

Looking to understand why and how to resolve.

[nayelyz (SmartThings Developer Support)]

Hi, @rst11
This is weird. You should be redirected to the “redirect URI” you defined in your app’s configuration, along with the authorization code as the query parameter. Have you checked if you receive that request on your server?

I haven’t seen this flow redirecting to the installedapp endpoint.

[rst11]

Hi @nayelyz . does this mean the &redirect_url= specified on the url the client is being directed to is completely ignored? can i remove it so not to cause confusion.

Are there any logs that i can view that will explain why the there is no call to the url specified on the application registration?

can you explain what you mean by:
>> I haven’t seen this flow redirecting to the installedapp endpoint.

many thanks

[nayelyz (SmartThings Developer Support)]

@rst11

&redirect_url= specified on the url the client is being directed to is completely ignored? can i remove it so not to cause confusion

No, it is used, but it must match the redirect URI you defined in your app’s configuration. Both must be present.

@rst11

why the there is no call to the url specified on the application registration?

Not directly, but you can test first if your URL passes this SSL test: SSL Server Test (Powered by Qualys SSL Labs)
If not, that could be the reason why no request reaches your server.

@rst11

https://api.smartthings.com/installedapp?

This URL you shared it’s similar to the installedapp endpoint of the API: API | Developer Documentation | SmartThings
So, I just was wondering why it was redirected there.

If the URL passes the test, we would need your help by replicating the issue and providing this information:

1. App ID
2. Timestamp of when you tried to authorize your app including your timezone. For example: 14:00 GMT-6

[rst11]

Hi @nayleyz. My app https address and certiciate all pass. How can i privately send you the details you have asked for?

[nayelyz (SmartThings Developer Support)]

Hi, @rst11, you can send me a direct message in this forum or an email to build@smartthings.com.

[rst11]

Hi Nayelyz. I have sent you a message. Thanks!

[Dyaa_4]

I have the same problem. I also wrote an email. Thank you!

[orangebucket (Graham)]

@Dyaa_4

I have the same problem. I also wrote an email. Thank you!

Something I have observed is that using the CLI command smartthings apps:oauth:generate (at least I think it was that one) results in a spurious https://apps.smartthings.com/installedapp/ being added as the first entry in the redirectUris array. There is still no obvious reason why it should be used instead of the specified one but I’ve had it happen.

[Dyaa_4]

I do not use this command. I create the app via Postman and I’ve defined my REDIRECT_URI in the body. If the URI were incorrect, I would receive an error in the response body stating that the REDIRECT_URI is invalid

Thank you

[Itati (SmartThing Developer Support)]

Hi @Dyaa_4

We received your email and noticed that your app type is App Type: WEBHOOK_SMART_APP. The correct app type should be API_ONLY.

Here are some instructions that might help you:

1. The option to create OAuth integrations cannot be found in the Developer Workspace.
2. You need to use the SmartThings CLI to create this type of app

Command:
smartthings apps:create
---->The type you need to select is “OAuth-In App”
----> Target URL is the link where you want to receive the subscription events
----> These scopes are the permissions whitelisted from your app, if you use a scope in the “authorize URL” not included in your app’s scopes, you’ll get an error
-----> Add redirect URI because that’s where you’ll receive the authorization code once the user authorizes access to your app.3. 4.

3. You can also use the JSON in this sample as the input for the command.
   GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices](GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices)
4. Then, you need to start the OAuth 2.0 process which consists on:

1. Show the authorization page to the user by using this URL:
   <https://api.smartthings.com/oauth/authorize?client_id=${clientId_from_app}&response_type=code&redirect_uri=${redirect_uri_from_app}&scope=${scopes_from_whitelisted_inApp}>
2. Once the user authorizes access to your app, it’ll redirect you to the “Redirect URI” you configured with the Authorization Code.
3. You’ll exchange this code for an Access Token. This is an example of that request:
   curl -X POST "<https://api.smartthings.com/oauth/token>" -u "${clientId_from_app}":"${clientSecret_from_app}" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=authorization_code&client_id=${clientId_from_app}&code=${codeReceived}&redirect_uri=${redirect_uri_from_app}"

5. The Access Token you get expires in 24 hours.
6. The Refresh Token expires in 29 days if not used. We suggest you refresh the token before this time, otherwise, you’ll lose the Refresh token and the User will need to re-authorize.

NOTE: Remember the OAuth integration has a limit of 500 installations by default. Each time a user authorizes access to one of his/her locations, it will count as 1 installation. This means, if a user has 3 locations and authorizes access to each of them, he/she will use 3 installations.

7. To refresh the Access Token, you need to use the same endpoint but the grant_type is different, here’s an example about this:

8. curl -X POST “https://api.smartthings.com/oauth/token” -u “${clientId_from_app}”:“${clientSecret_from_app}” -H “Content-Type: application/x-www-form-urlencoded” -d “grant_type=refresh_token&client_id=${clientId_from_app}&refresh_token=${latest_refresh_token}”

[Dyaa_4]

thank you so much for the fast response. I will try that