Hello,

I'm discovering OC200's OpenAPI interface with the Python code bellow:

OMADAHOST = '192.168.1.1'

OMADAPORT = 443

OMADAC_ID = 'xxx'

CLIENT_ID = 'xxx'

CLIENT_SECRET = 'xxx'

#curl "https://localhost:8043/openapi/authorize/token?grant_type=client_credentials" -H 'content-type:application/json' -d '{"omadacId": "de382a0e78f4deb681f3128c3e75dbd1", "client_id": "185586e0df424f5ea938de13cba91e01", "client_secret": "767372a5258a4fc1a03c57f3d071fc35"}' -X POST -i -k --insecure

headers0 = {'content-type': 'application/json'}
payload0 = json.dumps({'omadacId': OMADAC_ID, 'client_id': CLIENT_ID, 'client_secret': CLIENT_SECRET})
URL0 = f'https://{OMADAHOST}:{OMADAPORT}/openapi/authorize/token?grant_type=client_credentials'
toto = s.post(URL0, headers=headers0, data=payload0, verify=False)
print(toto.json())

I've got the following result:

{'errorCode': -44106, 'msg': 'The Client Id Or Client Secret is Invalid.'}

The values I used for OMADAC_ID, CLIENT_ID and CLIENT_SECRET where copied-pasted from Platform Integration web page.

At the same time, I can successfully log in (see [1]) and get an authorization code ([2]) but I can't also get any token [3]) with the authorization code I previously got.

I created a second API App and got the same results proving I either made a mistake while copying OMADAC_ID, CLIENT_ID and CLIENT_SECRET  or there is something wrong elsewhere.

Example URL are:

[1]

curl "https://localhost:8043/openapi/authorize/login?client_id=38f2d1b616434374b3f3215246f39940&omadac_id=beed48c7a2b0ea97c9698408843119f3" -H 'content-type:application/json' -d '{"username":"admin","password":"tplink123"}' -X POST -i -k --insecure

[2]

https://localhost:8043/openapi/authorize/code?client_id=29f2fdbeb5a84d50b9b1cdd08cd1a3ff&omadac_id=de382a0e78f4deb681f3128c3e75dbd1&response_type=code" -H 'content-type:application/json' -H 'Csrf-Token:ae6b935c92cf4b1b9f3eb852e20ed2b8' -H 'Cookie:TPOMADA_SESSIONID=9cb86bf3a99e48a59e4f3bb464a3c443' -X POST -i -k --insecure

[3]

curl "https://localhost:8043/openapi/authorize/token?grant_type=authorization_code&code=OC-y8fyWAyICCqCWw44Oi9GeSr7fQIKHg7g" -H 'content-type:application/json' -d '{"client_id": "29f2fdbeb5a84d50b9b1cdd08cd1a3ff", "client_secret": "cf6b13af0dd045628c9f05f088eb5493"}' -X POST -i -k --insecure

What am I doing wrong ? Any suggestion ?