Always response 401 (Unauthorized) for my Laravel Passport generated OAuth 2 token

Question

I am using:

Postman/Insomnia for REST checking
Laravel 5.6 with Laravel Passport
Vagrant (Apache 2, PHP 7.2)

Made all checklist described on Laravel Docs for Laravel Passport and after certain steps I receive HTTP 401 for my valid OAuth access token.

Requested by /oauth/token/ the new access token with client_id and client_secret.
Used received access token to authorize my simple Laravel REST test controller with included Oauth api middleware.
The end is one: 401 unauthorized :(

So, here is some of my configurations:

Apache

api route

Kernel.php

PassportServiceProvider.php

AuthServiceProvider.php

Why are you sharing screen shot? You can just add the code with your answer. — Shafi
@MASh sorry, I though that screenshot is more pretty visual for understanding then the code snippet. — Clark

user1455180 user1455180 · Accepted Answer · 2018-05-16T09:05:46

I had a very similar issue too:

The difference between your codes and mine: In the routes/api.php, i used only auth:api. I didn't create PassportServiceProvider.php in the app folder. In the Kernel.php mine is client not client_credentials.

I used client_credentials as grant_type in the POST request call. In the result I always got 401.

Until I created a user using Password Grant Client:

php artisan passport:client --password

And changed client_credentials to password in the POST request call:

$http = new GuzzleHttp\Client;

$response = $http->post('http://your-app.com/oauth/token', [
    'form_params' => [
        'grant_type' => 'password',
        'client_id' => 'client-id',
        'client_secret' => 'client-secret',
        'username' => 'taylor@laravel.com',
        'password' => 'my-password',
        'scope' => '',
    ],
]);

$access_token = json_decode((string) $response->getBody(), true)['access_token'];

Put the access token returned in the Bearer of the headers, and it works. And also you can get the current user using $request->user();

If you are using client_credentials as grant_type, it's going through the client middleware, so in the middleware auth:api needs to be removed.

Always response 401 (Unauthorized) for my Laravel Passport generated OAuth 2 token

2 Answers