Constant bad_verification_code

[marcoow]

Hey, I'm building a GitHub App and have enabled "Request user authorization (OAuth) during installation" so after installing my app, users get redirected to a URL like https://my.app.tld/github/install?code=d03d40d3f5ffe88facb6&installation_id=454565&setup_action=install. I then try and exchange that code for a proper token to get some basic info about the user:

const octokit = new Octokit({
  authStrategy: createOAuthUserAuth,
  auth: {
    clientId,
    clientSecret,
    code: authCode,
  },
});
const {
  data: { login },
} = await octokit.request("GET /user");

However, I keep receiving a bad_verification_code and I'm out of ideas why that might be happening.

data: {
      error: 'bad_verification_code',
      error_description: 'The code passed is incorrect or expired.',
      error_uri: 'https://docs.github.com/apps/managing-oauth-apps/troubleshooting-oauth-app-access-token-request-errors/#bad-verification-code'
    }

It's basically impossible for the code to be expired as I see the error right after the installation completes. I'm sure I'm doing sth. obvious wrong but can't seem to find out what that might be.

Also I realized that the logged request/response in the console look like this:

status: 400,
  request: {
    method: 'POST',
    baseUrl: 'https://github.com',
    headers: {
      accept: 'application/json',
      'user-agent': 'octokit-core.js/4.1.0 Node.js/16.18.1 (darwin; x64)'
    },
    mediaType: { format: '', previews: [] },
    request: { hook: [Function: bound bound register] },
    url: '/login/oauth/access_token',
    client_id: '…',
    client_secret: '…',
    code: 'd03d40d3f5ffe88facb6'
  },
  response: {
    status: 200,
    url: 'https://github.com/login/oauth/access_token',

which seems strange as it says status: 400, and status: 200, further down?

[oscard0m]

Is this issue still happening to you? Since it's using Octokit.js, I suggest you post this post in https://github.com/octokit/octokit.js/discussions

[marcoow]

I think this was a mis-configuration on our side actually – closing this…

[marcoow]

looks like I can't close this…