HiveSigner Provider Help

[trchristensen]

I'm trying to add a custom provider (hivesigner). I believe I am getting back the token but am getting "invalid grant, the code or secret is not valid. Could use some help 🙏

Hivesigner docs - https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

terminal

}
[next-auth][debug][get_authorization_url] https://hivesigner.com/oauth2/authorize?response_type=code&scope=offline,comment,vote,comment_option,custom_json&scope=&state=75d0cc5facc5002d6d188ba617d14496e3a1da2446a8c14017ccf0e8d2125cba&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fhivesigner&client_id=[name_redacted]
[next-auth][debug][oauth_callback_protection] Comparing received and expected state {
  state: '75d0cc5facc5002d6d188ba[redacted]ccf0e8d2125cba',
  expectedState: '75d0cc5facc5002d6d188ba[redacted]ccf0e8d2125cba'
}
[next-auth][error][oauth_get_access_token_error] 
https://next-auth.js.org/errors#oauth_get_access_token_error {
  statusCode: 401,
  data: '{"error":"invalid_grant","error_description":"The code or secret is not valid"}'
} undefined undefined
[next-auth][error][oauth_get_access_token_error] 
https://next-auth.js.org/errors#oauth_get_access_token_error {
  statusCode: 401,
  data: '{"error":"invalid_grant","error_description":"The code or secret is not valid"}'
} hivesigner eyJzaWduZWRfbWVzc........[REDACTED]..................JjOTk3Il19
[next-auth][error][oauth_callback_error] 
https://next-auth.js.org/errors#oauth_callback_error {
  statusCode: 401,
  data: '{"error":"invalid_grant","error_description":"The code or secret is not valid"}'
}

api/auth/[...nextauth].js

 {
      id: "hivesigner",
      name: "HiveSigner",
      type: "oauth",
      version: "2.0",
      scope: "offline,comment,vote,comment_option,custom_json",
      params: { grant_type: "authorization_code" },
      clientId: process.env.HIVESIGNER_ID,
      clientSecret: process.env.HIVESIGNER_SECRET,
      authorizationUrl: "https://hivesigner.com/oauth2/authorize?response_type=code",
      accessTokenUrl: "https://hivesigner.com/api/oauth2/token",
      requestTokenUrl: "https://hivesigner.com/api/oauth2/auth",
    },

[balazsorban44]

I would double-check the clientSecret value to begin with. That is what the terminal says.

requestTokenUrl is not used here, you are using OAuth 2.0, not 1.0, so it can safely be removed.

[trchristensen]

Thank you. I'm still unable to get it to work but like you said, it probably has to do with the client secret.

I've changed it several times and still no luck. In hivesigner's dashboard you provide a secret, which I'm assuming should be a random hex string? After which, a secret (different string) is returned. I stored that as my HIVESIGNER_SECRET. https://ibb.co/d0n6TF5

I tried pasting the token I received back in the terminal in jwt.io and I'm getting "Invalid signature".

Anyway, Appreciate the help!

[balazsorban44]

the secret should be the same as the one before returning! it probably looks different so that someone with access to your dashboard could not get access to your app. think of client secrets as a password between the app and your OAuth provider

If my assumptions are correct, you were using the stored/hashed version, instead of the real "password".

the secret shouldn't be saved anywhere else, once it's set in the dashboard, only set it as an env variable in your app. if you loose access to the value, remove the old one from the dashboard, and generate a new one instead.

[trchristensen]

Ahh that makes sense. That definitely helped fix the invalid signature error. Now I'm getting a different error which I can't seem to figure out.

https://next-auth.js.org/errors#oauth_get_access_token_error {
  statusCode: 401,
  data: '{"error":"invalid_grant","error_description":"The token has invalid role"}'

I think this means that the callback url is wrong? I have added a redirect_uri param since it was telling me there is no url provided and it is included in the documentation on their github:

 {
      id: "hivesigner",
      name: "HiveSigner",
      type: "oauth",
      version: "2.0",
      scope: "offline,comment,vote,comment_option,custom_json",
      params: { grant_type: "authorization_code" },
      clientId: process.env.HIVESIGNER_ID,
      clientSecret: process.env.HIVESIGNER_SECRET,
      redirect_uri:
        "http://localhost:3000/api/auth/callback/hivesigner",
      authorizationUrl: "https://hivesigner.com/oauth2/authorize",
      accessTokenUrl: "https://hivesigner.com/api/oauth2/token",
    },

Not sure where to go from here.

[balazsorban44]

the redirect URI is the one that you register in your provider's dashboard, not in the next-auth config.

When the sign-in flow starts, a mildly complicated there and back communication between your app and your provider makes sure that credentials are exchanged safely.

Therefore specifying the redirect URI (also called callback url) in the provider, it knows that it is safe to return to your app, because you explicitly tell it to.

Auth0 (a leading authentication platform) has this very good flow chart about the whole login process:

https://auth0.com/docs/flows/authorization-code-flow

it's for visualizing only, you don't have to worry about it, we do most of the things behind the scenes in next-auth for you.

step 5 on the chart, where your app will receive something from the provider, on a special url. the one that you set as redirect_uri. It is the provider that needs to know this url, so you set it in your provider.

the value you set looks correct though.

[trchristensen]

That diagram is really helpful. So my app is requesting user data with the access token and hivesigner is giving me back an invalid token role response. Thanks again for the help. Hopefully I'll get this sorted out.