Problem getting access token

[eriksjolander]

We have just launched our integration with Visma.net but are having problems onboarding our first users.
We redirect them to:
https://connect.visma.com/connect/authorize?client_id=isv_boardeaser&redirect_uri=https%3A%2F%2Fapp....
(With some real state, I removed it in this example)
They are prompted to login and select their organization, then they are redirect back to our app with a code and the state.
We make a POST request to
https://connect.visma.com/connect/token
username: isv_boardeaser
In the body we include:
code - that we receive from you in the callback url
grant_type=authorization_code
redirect_uri=https://app.boardeaser.com/integrations/visma_net
The response is 400 with body {"error":"invalid_request"}.
Do you have any idea what might be going wrong with this client?
We have been successful with connecting it to our own ISV-account.

[eriksjolander]

Do you have any idea why it works when we test on Companies in ISV Boardeaser AB but not for our customers?

When I go through the same flow as a customer:

1. Sign in to Boardeaser

2. Click on our generated authorize link ( https://connect.visma.com/connect/authorize?client_id=isv_boardeaser&redirect_uri=https%3A%2F%2Fapp....)

3. I sign in to Visma.net

4. I select `Visualby Test Company`

5. It redirects to Boardeaser

6. We request a token ( https://connect.visma.com/connect/token)

7. The account is connected.

But for our customer it fails on step 6 and we get `invalid_request` as the error message with status 400.

The API call for step 6 is as follows:

POST https://connect.visma.com/connect/token

code=valid_code&grant_type=authorization_code&redirect_uri=https%3A%2F%2Fapp.boardeaser.com%2Fintegrations%2Fvisma_net&client_id=isv_boardeaser&client_secret=fake_secret

headers: {"Accept"=>"*/*", "User-Agent"=>"rest-client/2.1.0 (darwin23 arm64) ruby/3.3.1p55", "Content-Type"=>"application/x-www-form-urlencoded", "Content-Length"=>"150", "Accept-Encoding"=>"gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "Host"=>"connect.visma.com"

response status: 400
body: {"error":"invalid_request"}

[Marten Voort]

Can you check if the users have api-user rights? This can be configured in Visma.net admin. See also https://community.visma.com/t5/Forum-in-Developers-Visma-net/VISMA-net-shows-error-page-during-OAuth...

[eriksjolander]

We have now validated that the customer has API-user rights. We tried removing the rights from one of our test users and get a access denied message in the authentication process when that is the case.  The customer can go through the whole authentication process and pick the correct company but still gets a 400 response with {"error":"invalid_request"} in the token request.

[Marten Voort]

The only way I can reproduce this error if I leave the body completely empty. I suspect there is something wrong with the url encoding or form structure of the body. If this does not help you, I suggest you take this up with local support, because we need to do an in-depth check on what is the cause of this error. You can find local support on this page: https://community.visma.com/t5/Forum-in-Developers-Visma-net/Update-on-Visma-net-ERP-API-Support-cha...

[Marten Voort]

Hi Erik, I see you have a username in the request, this should not be needed. Furthermore, some fields seem to be missing in the body of your token request. It should be like this Curl example request:

curl --request POST --url https://connect.visma.com/connect/token --header 'content-type: application/x-www-form-urlencoded' --data 'grant_type=authorization_code&redirect_uri=https%3A%2F%2Fdemoapp.example.com/oauthcallback%2Fcallback&code=94c99b73c13c1e39f7b0a7d259628338&client_id=demoapp&client_secret=SECRET'

Let me know if this helps you.

[eriksjolander]

After making the changes you suggested, we still get the same error when trying to get a token for the customer. It still works perfectly fine when we try with our own test users.