Unable to exchange OAuth auth code for access token

Question

I'm just trying to make a simple app, but I can't even get past authenticating the user. I am using the Google OAuth Client Library for Java.
These are the current steps I am taking:

1. Start local web server to listen for the loopback response after the OAuth authentication.

2. Generate the auth URL:

   String url = new AuthorizationCodeRequestUrl(AUTH_URL, CLIENT_ID)   
           .setScopes(scopes) // Contains https://www.googleapis.com/auth/drive.readonly
           .setRedirectUri(LOCALHOST + r.getPort()) // Port of local web server
           .build();
   

3. Use URL to authenticate account.
4. Google returns auth code.

5. Exchange auth code for access token.

   TokenResponse token = new AuthorizationCodeTokenRequest(...)
   .setRedirectUri("http://localhost") // <--
   .setClientAuthentication(getClientAuth()) // ClientParametersAuthentication object
   .execute();
   

This is where my problem occurs. No matter what value I put in for redirect_uri, I always get {"error":"redirect_uri_mismatch","error_description":"Bad Request"} in return.
Searching Google for the error, every single result says that it's because the redirect_uri I sent is not registered in the API console.
When I download the credentials json file, the redirect_uris section contains "urn:ietf:wg:oauth:2.0:oob","http://localhost", but it's all the same error no matter what I put in.

I went to the Credentials section of the project to fix it, but since this is an installed application, creating credentials for the project gives me no option to set any redirect uris. The only way to get access to changing redirect_uris are to create the credentials for "Web application," but this isn't a web application and I don't have a domain it can redirect to.

So I'm stuck, redirect_uri options are not available to me and no value that I use works, I honestly don't know what else to try. What steps can I take to fix this?

Answer 1

It turns out that the same redirect_uri must be used for the auth code and access token even if it's not going to be used for retrieving the access token.