Issues in getting access_token fromm OAUTH flow

[MelMacaluso]

Hi there

We successfully follow this guide but in step 4-5 (OAuth authorization) we are facing some issues:

1. If we pass the based64-edAuthorization header and hit the endpoint at https://oauth.pipedrive.com/oauth/token with a POST request and an additional content-type header of application/x-www-form-urlencoded we receive an error in the POST request as its PREFLIGHT request is rejected:
   
   , basically the endpoint on PD’s end does no support the Authorization header on PREFLIGHT requests…
2. If we instead do what is suggested as an alternative, passing client_id and client_secret in the body request we get an error claiming that the cors origin (localhost) in his case, is not allowed…

Suggestions welcome

[r2d2]

Hi,
You would find this response helpful

Is there a way to consume API using OAuth without passing the `client_secret` that'd be held browser side?

Hey @maxime1992 Welcome to the community You are right that the client_secret should not be exposed. The client_id and client_secret information is used to identify the app that is requesting authorization (consent from the user). It is the responsibility of the app to maintain the confidentiality of the client_secret (Ref. rfc6749) Depending on whether the user has granted the consent, the app is expected to exchange the authorization code for access + refresh token. This commu…

Feel free to create a new topic if you still face issues.