REST API cURL Token - Paylocity

Question

This should be very simple, but for the life of me I can not form my cURL request so that Paylocity will accept it. https://www.paylocity.com/integrations/apis/

I keep getting HTTP/1.1 400 Bad Request with json response {"error":"invalid_client"}, which I believe indicates that the data I am sending is not formatted properly. If I mess with the data I can get different response codes. In this case I am simply trying to obtain a bearer token.

curl  -v https://apisandbox.paylocity.com/IdentityServer/connect/token \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'Authorization:Basic <base64 encoded  clientid:clientsecret>' \
-d  'grant_type = client_credentials&scope = WebLinkAPI'

Anything obviously wrong with the above?

Are these blank spaces in the payload intentional or just for the sake of readability here? Usually there shouldn't be a blank space in the content as this needs to be properly form-encoded. You could also replace the Authorization header with a direct --user clientid:clientsecret directly and curl will add the base64 encoded basic authorization header for you. While curl should use POST automatically on providing a payload via -d, I prefer to set it explicitly via -X POST just to be sure. — Roman Vottner
@RomanVottner The spaces were not supposed to be there, when testing we did not have spaces. Thank you for pointing that out. We finally figured it out, my programmer happened to have been working on another issue with postman on Windows (we normally work in Linux, go figure). Apparently windows compiles postman will show different output than on Linux. We were able to use this information to properly format the body. (see my answer) — TurboAAA

TurboAAA TurboAAA · Accepted Answer · 2019-10-03T16:31:59

Finally found the answer thanks to postman compiled for Windows (FYI, for us postman on Windows gives different output than postman on Linux). When postman sends the request it does NOT use a base64 authentication header as described by Paylocity's documentation. Instead it places the client_id and client_secret in the body. In addition, postman would url encode the id and secret strings.

i.e. "==" becomes "%3D%3D", "+" becomes "%2B", and "/" becomes "%2F"

Also, using the api sandbox did not work. We had to authenticate against the production server as well.

curl -X POST -i \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=client_credentials&scope=WebLinkAPI&client_id=<client ID>&client_secret=<client secret>' \
https://api.paylocity.com/IdentityServer/connect/token

REST API cURL Token - Paylocity

1 Answers