Unable to refresh token with PKCE flow

[Neumann_]

I'm using the PKCE flow in my SPA.

The initial authorization call works fine, with the following body parameters :

code: AQC...

redirect_uri: http://localhost:3000/myapp

grant_type: authorization_code

code_verifier: DHo4...

client_id: f50...

Spotify returns an acces_token, along with a refresh_token. However, the refresh request doesn't work. Here are the body parameters I use in the refresh request :

grant_type: refresh_token

refresh_token: AQD...

client_id: f50...

Spotify then returns a 400 error : {"error":"invalid_client"}

Needless to say that both these requests have NO authentication header, since PKCE doesn't require it.

Note that before trying to implement this, my code was using classic authorization flow, using basic authentication with client_id/secret_id. Refresh requests worked fine.

[Neumann_ · Accepted solution]

The mistake was on my side, I was sending a "Authorization : null" header in the token refresh request.

My bad