在PHP页面上使用带有CURL的OAUTH API

Question

I'm working with a PHP website where I want to integrate to some 3rd party API.

In particular I am looking at using CURL to interact with their server but this is something I am far from an expert in so hoping the community can help me gain a better understanding of what I am doing.

I am unclear what options such as -X and -d do, also I am unclear how I script this command on my PHP page? (Unfortunately it's tricky searching google for "-d" as this isn't considered part of the search string)

My particular example I am stuck on is requesting an access token, the API documentation provided to me is;

curl -X POST \
-d \ "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=REQUESTED_SCOPES" \
'https://api.example.com/token'

grant_type- client_credentials

client_id- Generated during setup

client_secret - Web apps only, generated during setup

scope Optional - List of comma separated values, see supported scopes

If the request is successful, an access token will be returned in the response:

 {
"access_token":"ACCESS_TOKEN",
"token_type":"Bearer",
"expires_in":3600
"scope":"REQUEST_SCOPES"
}

That is the above guidance, I have completed the pre-requisites so can confirm the client id, secret and required scope are correct.

I have tried both of the following in vein in my PHP script

$tk = curl_init();

curl_setopt($tk, CURLOPT_URL, "https://api.example.com/token");
curl_setopt($tk, CURLOPT_POST, 1);
curl_setopt($tk, CURL_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($tk, CURLOPT_POSTFIELDS, array( 'grant_type=client_credentials&client_id=myownid&client_secret=xyz123&scope=instrument'));

// grab URL and pass it to the browser
$result=curl_exec($tk);

// close cURL resource, and free up system resources
curl_close($tk);

And

$tk = curl_init();

curl_setopt($tk, CURLOPT_URL, "https://api.example.com/token?grant_type=client_credentials&client_id=myownid&client_secret=xyz123&scope=instrument");
curl_setopt($tk, CURLOPT_POST, 1);
curl_setopt($tk, CURL_HTTPHEADER, array('Content-Type: application/json'));

// grab URL and pass it to the browser
$result=curl_exec($tk);

// close cURL resource, and free up system resources
curl_close($tk);

Both of these examples produce the following error;

{"error_description":"grant_type parameter is missing","error":"invalid_request"}

Any help on this particular issue or even to just understand how I am going wrong to give me some ideas of the correct syntax will be much appreciated!

Thank you all in advanced for your time.

• (Please note I've changed to "example.com" for security of the 3rd party)

Answer 1

Check out below sample code of cURL call in php. You need to change your domain name instead of example.com also put values for POSTFIELDS.

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => "https://api.example.com/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"grant_type\":\"client_credentials\",\"client_id\": \"YOUR_CLIENT_ID\",\"client_secret\": \"YOUR_CLIENT_SECRET\",\"scope\": \"instrument\"}",
  CURLOPT_HTTPHEADER => array(
    "content-type: application/json"
  ),
));

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}