Better message about exchange token

[jimmyshiau]

When @cor3000 tring to exchange token, he put param in query string
https://quire.io/oauth/token?grant_type=client_credentials&client_id=...&client_secret=...
and we return

{"error":"unsupported_grant_type","error_description":"The supported grant types are 'authorization_code', 'refresh_token'."}

It was caused by we need to put params into post body

curl -d "grant_type=client_credentials&client_id=...&client_secret=.." -X POST https://quire.io/oauth/token

He think it is a confusing error message

a helpful error message might be:" query parameters not supported, use request body"

for Asana, they just return error page
https://app.asana.com/-/oauth_token?grant_type=client_credentials&client_id=...&client_secret=...

[davismj]

Had the same issue, but neither worked for me:

query params

form data

json body

At the very least I'd expect a json body to work, but maybe return a 400 and ask for a x-www-form-encoded when the body is completely empty.

[cor3000]

According to the spec (rfc6749) json isn't expected/required on this request type (4.1.3 Access Token Request) - even though the response content type is JSON.

Unfortunately no reason is given. So maybe supporting a JSON request body is acceptable, for user convenience.
Maybe it's considered harmful/risky to support multiple content types due to increased implementation complexity.

In any case a meaningful error message would help. Errors are described in 5.2 Error Response

[davismj]

Agree. docs issue then!