Hubspot Webhooks: Redirect Auth & BAD_GRANT_TYPE Message

Question

I'm trying to add a custom app in Hubspot. I'm using PHP. I have:

• A Hubspot app
• A working webhook URL

• A redirect URL with the following code

  $url = 'https://api.hubapi.com/oauth/v1/token';
  $code =  $_GET['code']; // Getting code parameter from redirect URL
  //echo $code;
  $fields = array();
  $fields['grant_type'] = 'authorization_code'; // Have also tried 'refresh_token' - same result
  $fields['client_id'] = '{CLIENT_ID}';
  $fields['client_secret'] = '{CLIENT_SECRET}';
  $fields['redirect_uri'] = '{REDIRECT_URI}';
  $fields['code'] = trim($code);
  //$fields['refresh_token'] = trim($code);  // Have also tried 'refresh_token' - same result
  
  $request_type = 'POST';
  
  $ch = curl_init($url);
  curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept: application/json', $headers));
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_CUSTOMREQUEST, POST); 
  curl_setopt($ch, CURLOPT_TIMEOUT, 30);
  curl_setopt($ch, CURLOPT_POST, 1);
  if($fields){
      curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($fields));
  }
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
  $return = curl_exec($ch);
  curl_close($ch);
  echo var_dump ($return);    
  

• My understanding is that Hubspot will use the 'code' parameter passed to the on the "authorization" URL to validate the authorization. However, I keep getting this error:

  string(171) "{"status":"BAD_GRANT_TYPE","message":"missing or unknown grant type","correlationId":"f0508752-24bc-40e4-b0bc-51e358459653","requestId":"96044613d4e4a5aab7356fab04001e5c"}"

Answer 1

I had the same error response and it seemed that this is an encoding issue.

I debugged with Postman and found out that the following code works:

<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => "https://api.hubapi.com/oauth/v1/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "grant_type=authorization_code&code=string&redirect_uri=string&client_id=string&client_secret=string",
  CURLOPT_HTTPHEADER => array(
    "content-type: application/x-www-form-urlencoded",
    "Cookie: __cfduid=someidfrompostman"
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;