PayPal get access token with CURLSMBS

Hi All

I have run into a bit of a road block with my API for PayPal. I am using similar code in some other API’s to get accounting data & they work fine.

However with PayPal, I am getting a 401 error using this header info…

{“error”:“invalid_client”,“error_description”:“Client Authentication failed”}

	using xojo.core
	Dim c as new CURLSMBS
	Dim key as String = PayPalAPIClientID + ":" + PayPalAPISecret
	
	Dim requestHeaders(3) as String
	requestHeaders(0) = "Accept: application/json"
	requestHeaders(1) = "Accept-Language: en_US"
	requestHeaders(2) = "Authorization: Basic " + key
	requestHeaders(3) = "grant_type=client_credentials"
	c.SetOptionHTTPHeader requestHeaders
	
	c.CollectDebugData=True ' For debug purpose
	c.OptionVerbose=True ' For debug detailed information
	c.CollectOutputData = True
	c.OptionSSLVerifyPeer = 0
	c.OptionFollowLocation = true
	c.OptionSSLVerifyHost = 0
	c.OptionPost = true
	c.OptionURL = URL

I have double checked the ClientID & Secret so I know they are ok. I believe that I must be formatting the header the wrong way.

PayPal’s cURL access token request example show this code.

curl -v https://api.sandbox.paypal.com/v1/oauth2/token \
-H “Accept: application/json” \
-H “Accept-Language: en_US” \
-u “EOJ2S-Z6OoN_le_KS1d75wsZ6y0SFdVsY9183IvxFyZp:EClusMEUk8e9ihI7ZdVLF5cZ6y0SFdVsY9183IvxFyZp” \
-d “grant_type=client_credentials”

What I am not sure about are prefix’s -H, -u & -d. Although in their API document there is a reference to -u being flag: - I have tried it in the following code but still get a 401 error.

	using xojo.core
	Dim c as new CURLSMBS
	Dim key as String = PayPalAPIClientID + ":" + PayPalAPISecret
	
	Dim requestHeaders(3) as String
	requestHeaders(0) = "Accept: application/json"
	requestHeaders(1) = "Accept-Language: en_US"
	requestHeaders(2) = “flag: " + key
	requestHeaders(3) = "grant_type=client_credentials"
	c.SetOptionHTTPHeader requestHeaders
	Etc…

Any help, comments & pointers would be great

Thanks Chris

PS this a web App runing on Xojo Cloud.

The command -d "grant_type=client_credentials" specifies a a url-encoded form to post, not an HTTP header.

-u sets the username and password to be used in the Authorization: header. Don’t try to set it as a header, instead set the OptionPassword and OptionUsername properties and curl will set the correct headers for you.

Thanks Andrew

The link to url-encoded form is very useful…

Anyway I have 200 ok response back from PayPal so I can keep going.