Generate Access Token issue when used Enforce Scope

[lang1]

Please help,
I've been trying to create a function to generate Access token. It's working when there is no limit on Developer Key as I get Access Token in the response.

When I send a request to get the access token via "/login/oauth2/token", the response has Access Token as NULL. I have the bellow params submitted as JSON

"client_id=id"
"client_secret=key"
"code=abcdefg..."
"grant_type=authorization_code" **** tried with and without this and still get NULL access token

Response from Canvas
"{""access_token"":null,""token_type"":""Bearer"",""user"":{""id"":1,""name"":""My Account",""global_id"":""123456789"",""effective_locale"":""en""},""canvas_region"":""us-east-1"",""expires_in"":-664}"

What am I missing here? 
Let me know.
Thanks.

[matthew_buckett]

When you start the OAuth 2 flow you need to supply the scopes that you are requesting a token to have access to: https://canvas.instructure.com/doc/api/file.oauth_endpoints.html#get-login-oauth2-auth

Although I would have expected you to get an error at this point if your developer key is marked as having scopes enforced.

[lang1]

I did not have any error. I got to the page where required admin to click Authorize the App to access the account.  I have "scope=/auth/userinfo" when requesting the Authorization Code via /login/oauth2/auth. I got that code to request the access token. Also I thought scope only needed when grant_type is client_credentials when requesting for an access token?

What is the scope needed for /login/oauth2/token when request for token? I can't tell from the documentation. It's not clear. Can you point me there?

[matthew_buckett]

The "scope=/auth/userinfo" is used when you want to have Canvas be used for users to login to your applications/website. That scope doesn't allow you to make API requests to Canvas. This is outlined here: https://canvas.instructure.com/doc/api/file.oauth.html#oauth2-flow

If you are wanting to get an API token you need to get the user to got through the OAuth flow again, either without asking for any scopes (which means you get full access to the account), or with a limited set of scopes that you set in the developer key.

To get started it's probably simplest to leave your developer key without scopes enforced and not pass in any scopes when you start the OAuth flow. This should give you a token that you can use on any API endpoint. Then once you've got it working you can look at enforcing scopes on the developer key and requesting those scopes in the OAuth flow.

[lang1]

I was able to generate the access token and refresh token with Enforce Scopes set to off. I then turned on Enforce Scopes, selected the necessary scopes and getting "Insufficient scopes" error on all requests.

For a simple example: Despite enabled this scope url:GET|/api/v1/accounts/:id and still got error below.

API Response - CanvasGetAccountById:[/api/v1/accounts/1] returned status[401]: Unauthorized {"errors":[{"message":"Insufficient scopes on access token."}],"error_report_id":83589}

Thought?

Circling back to the original question with Null access token returned, what are the exact necessary scopes to use when requesting the access token "/login/oauth2/token" with code/dev keys? ( the doc is a little not too clear about this)

Let me know.
Thanks

[MatthewStahlman]

Where on that page are the scopes actually listed, and where is the explanation of what scopes are needed? 

[SravanMaru]

Hi @lang1 ,

Can you please help me out that how you got the  Authorization Code via "/login/oauth2/auth". Iam facing a invalid_scope error although i have mentioned scope as  "scope=/auth/userinfo"..

Thanks in Advance.

[DigVargasDye]

 The scope you need in your auth code request is something like "url:GET|/api/v1/users/:user_id/profile" (getting the user's profile gets most "userinfo" you would need).

This is assuming the SAME scope is selected int he corresponding Developer Key scope within the Canvas UI.

So the call would be roughly:

"https://yourapp.instructure.com/login/oauth2/auth?client_id=API_KEY_CLIENT_ID&response_type=code&redirect_uri=https://yourapi.com/getuserinfoauthcode&scope=url:GET|/api/v1/users/:user_id/profile" 

With the endpoint "getuserinfoauthcode" unpacking the auth code for the subsequent access token call.

@SravanMaru

[lang1]

You have to declare the necessary scopes &scope= on the submit of OAUTH on /login/oauth2/auth