404 error=invalid_request&error_description=The+request+is+malformed

[rst11]

Hi, I am implementing the oauth2 part of my smartapp and the authorize step directs to error=invalid_request&error_description=The+request+is+malformed.

I am directing user to
https://api.smartthings.com/oauth/authorize?response_type=code&client_id=3446d2fc-7541-4758-ad03-e781bb8fb82&redirect_url=https://www.MYDOMAIN.co.uk:5000/callback

as a user I am able to login, select the location and devices and click the authorize button.
This directs to the https://api.smartthings.com/installedapp?error=invalid_request&error_description=The+request+is+malformed. url and a 404 error.

Looking to understand why and how to resolve.

[nayelyz]

Hi, @rst11
This is weird. You should be redirected to the “redirect URI” you defined in your app’s configuration, along with the authorization code as the query parameter. Have you checked if you receive that request on your server?

I haven’t seen this flow redirecting to the installedapp endpoint.

[rst11]

Hi @nayelyz . does this mean the &redirect_url= specified on the url the client is being directed to is completely ignored? can i remove it so not to cause confusion.

Are there any logs that i can view that will explain why the there is no call to the url specified on the application registration?

can you explain what you mean by:
>> I haven’t seen this flow redirecting to the installedapp endpoint.

many thanks

[nayelyz]

@rst11

&redirect_url= specified on the url the client is being directed to is completely ignored? can i remove it so not to cause confusion

No, it is used, but it must match the redirect URI you defined in your app’s configuration. Both must be present.

@rst11

why the there is no call to the url specified on the application registration?

Not directly, but you can test first if your URL passes this SSL test: SSL Server Test (Powered by Qualys SSL Labs)
If not, that could be the reason why no request reaches your server.

@rst11

https://api.smartthings.com/installedapp?

This URL you shared it’s similar to the installedapp endpoint of the API: API | Developer Documentation | SmartThings
So, I just was wondering why it was redirected there.

If the URL passes the test, we would need your help by replicating the issue and providing this information:

1. App ID
2. Timestamp of when you tried to authorize your app including your timezone. For example: 14:00 GMT-6

[rst11]

Hi @nayleyz. My app https address and certiciate all pass. How can i privately send you the details you have asked for?

[nayelyz]

Hi, @rst11, you can send me a direct message in this forum or an email to build@smartthings.com.

[rst11]

Hi Nayelyz. I have sent you a message. Thanks!

[Dyaa_4]

I have the same problem. I also wrote an email. Thank you!

[orangebucket (Graham)]

@Dyaa_4

I have the same problem. I also wrote an email. Thank you!

Something I have observed is that using the CLI command smartthings apps:oauth:generate (at least I think it was that one) results in a spurious https://apps.smartthings.com/installedapp/ being added as the first entry in the redirectUris array. There is still no obvious reason why it should be used instead of the specified one but I’ve had it happen.

[Dyaa_4]

I do not use this command. I create the app via Postman and I’ve defined my REDIRECT_URI in the body. If the URI were incorrect, I would receive an error in the response body stating that the REDIRECT_URI is invalid

Thank you

[Itati]

Hi @Dyaa_4

We received your email and noticed that your app type is App Type: WEBHOOK_SMART_APP. The correct app type should be API_ONLY.

Here are some instructions that might help you:

1. The option to create OAuth integrations cannot be found in the Developer Workspace.
2. You need to use the SmartThings CLI to create this type of app

Command:
smartthings apps:create
---->The type you need to select is “OAuth-In App”
----> Target URL is the link where you want to receive the subscription events
----> These scopes are the permissions whitelisted from your app, if you use a scope in the “authorize URL” not included in your app’s scopes, you’ll get an error
-----> Add redirect URI because that’s where you’ll receive the authorization code once the user authorizes access to your app.3. 4.

3. You can also use the JSON in this sample as the input for the command.
   GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices](GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices)
4. Then, you need to start the OAuth 2.0 process which consists on:

1. Show the authorization page to the user by using this URL:
   <https://api.smartthings.com/oauth/authorize?client_id=${clientId_from_app}&response_type=code&redirect_uri=${redirect_uri_from_app}&scope=${scopes_from_whitelisted_inApp}>
2. Once the user authorizes access to your app, it’ll redirect you to the “Redirect URI” you configured with the Authorization Code.
3. You’ll exchange this code for an Access Token. This is an example of that request:
   curl -X POST "<https://api.smartthings.com/oauth/token>" -u "${clientId_from_app}":"${clientSecret_from_app}" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=authorization_code&client_id=${clientId_from_app}&code=${codeReceived}&redirect_uri=${redirect_uri_from_app}"

5. The Access Token you get expires in 24 hours.
6. The Refresh Token expires in 29 days if not used. We suggest you refresh the token before this time, otherwise, you’ll lose the Refresh token and the User will need to re-authorize.

NOTE: Remember the OAuth integration has a limit of 500 installations by default. Each time a user authorizes access to one of his/her locations, it will count as 1 installation. This means, if a user has 3 locations and authorizes access to each of them, he/she will use 3 installations.

7. To refresh the Access Token, you need to use the same endpoint but the grant_type is different, here’s an example about this:

8. curl -X POST “https://api.smartthings.com/oauth/token” -u “${clientId_from_app}”:“${clientSecret_from_app}” -H “Content-Type: application/x-www-form-urlencoded” -d “grant_type=refresh_token&client_id=${clientId_from_app}&refresh_token=${latest_refresh_token}”

[Dyaa_4]

thank you so much for the fast response. I will try that

[Dyaa_4]

Hey, I tried that, but I need WEBHOOK_SMART_APP to receive calls from SmartThings when a device changes its state. When I use the API_ONLY type, I can’t use the webhook functionality. i need a way to use the api to controll my device state and to get his state from the webhook

[orangebucket (Graham)]

@Dyaa_4

Hey, I tried that, but I need WEBHOOK_SMART_APP to receive calls from SmartThings when a device changes its state. When I use the API_ONLY type, I can’t use the webhook functionality. i need a way to use the api to controll my device state and to get his state from the webhook

API_ONLY apps receive CONFIRMATION and EVENT messages from SmartThings on the ‘target URL’ just as WEBHOOK_SMART_APP apps do. The difference is that instead of a lifecycle property in a request from SmartThings you get a messageType.

As you are basically setting things up from the server end rather than responding to requests from SmartThings, you don’t get CONFIGURATION, INSTALL, or UPDATE lifecycle requests. However you can still create subscriptions as you would typically have done in response to those INSTALL or UPDATE requests and you will receive EVENT messages.

[Dyaa_4]

Hey Orangebucket, thank you so much for your answer i tried to subscribe for my device, but SmartThings didn’t trigger or call my webhook, my webhook is also currect “apiOnly”: {
“targetUrl”: “https://api.screen-board.com/api/auth/smartthings/webhook”

[Dyaa_4]

I have set up my webhook with

router.post("/auth/smartthings/webhook", (req, res) =>
    smartThingsController.handleWebhook(req, res));

I believe I’ve done everything correctly, but Samsung/SmartThings never calls the webhook. I tested by turning off the light via Alexa, but nothing happens—even though I have an active subscription.

[orangebucket (Graham)]

@Dyaa_4

my webhook is also currect “apiOnly”: {
“targetUrl”: “https://api.screen-board.com/api/auth/smartthings/webhook”

I believe that’s how it looks in the input when creating or updating apps from JSON, but it should end up looking like this is the app object when it is ready to go:

    "apiOnly": {
        "subscription": {
            "targetUrl": "https://api.screen-board.com/api/auth/smartthings/webhook",
            "targetStatus": "CONFIRMED"
        }
    },

You need to use smartthings apps:register (or an API equivalent) to trigger the CONFIRMATION cycle to verify your target URL (though I believe it also gets called if you define the target URL when you first create an app). That’s the same deal as with Webhook SmartApps.

[Dyaa_4]

@orangebucket

smartthings apps:register

oh thank you so much ! i did now. Registration request sent to app xxxxx. Check server log for confirmation URL: undefined i will try

[Dyaa_4]

Thank you so much, I got my events!

Last thing:
How long is the subscription valid?
Does it not have an expiration?

[orangebucket (Graham)]

@Dyaa_4

How long is the subscription valid?
Does it not have an expiration?

Perhaps slightly surprisingly, they don’t expire. You just have to delete them when you no longer need them.