How to get it working???

A "CRID" - Customer Registration Identification and a "MID" - Mailer Identification. The Postal service shows the example

Prepare your credentials for use in the following examples:

CLIENT_ID=XXXX
CLIENT_SECRET=XXXX
CUSTOMER_REGISTRATION_ID=XXXX
MAILER_ID=XXXX

Example OAuth Client Credentials Token request:

curl -X 'POST' 'https://apis.usps.com/oauth2/v3/token' \
--header 'Content-Type: application/json' \
--data '{
"client_id": "{{CLIENT_ID}}",
"client_secret": "{{CLIENT_SECRET}}",
"grant_type": "client_credentials"
}'

at https://github.com/USPS/api-examples using CURL.

However I do not get the form Oauth2ClientForm.php anywhere

In the above example I simply used the small case code call and Oauth2_client does not report any installed clients

Yes I did that. I copied all four examples, changed the namespace to the module name, and put it in Plugin/Oauth2Client under the "src" directory of my module and adjusted the files removing "Example" from everywhere it was found and replaced theurls with the correct ones for USPS and removed the " * " from the " @0auth2Client( " code

I do have the key module installed and it is holding stripe values currently

There is nothing in admin/config/Oauth2-client and says no clients are configured yet

There is no button for a new client or to get a test token etc

Thank you for that. I use WinSCP, so I copied the entire "Examples" directory to my module and changed ONLY the namespace. Still nothing until the caches were cleared. Up came the files and the form was accessible; however, if the file is directly modified to remove the "*" - then it does not like the equals sign and throws

ParseError: syntax error, unexpected token "=", expecting ")" in Composer\Autoload\{closure}() (line 18 of modules/xxxxxxxxxxxx/src/Plugin/Oauth2Client/AuthCodeExample.php). and for any line with an " = " sign

Also the clients are impossible to delete, are they entities which must be deleted with entity delete ???

Thus there is no url to request a token from

I renamed one file to remove the "example" from it php name by duplicating it - and it worked, however still it too is impossible to delete.

Even if I delete the entire Oauth2client directory from the plugin directory still it complains looking for the old files.

Putting them back will let it work again

But this is still a "BUG" because of the " = " sign issue and the impossibility to delete clients

Where does and how does the

$access_token = Drupal::service('oauth2_client.service')->getAccessToken($client_id);
$token = $access_token->getToken();

go in the code??

It should be noted the "Instagram" connection syntax appears to work with the " : " instead of the " = " sign as at least it does not throw a syntax error, but the file still seems to locked to " oauth.mocklab.io " as the authorization url so it still does not work even I clear the cache and / or rebuild the cache

Attempting to fix the @Oauth2Client( code throws

ParseError: syntax error, unexpected token "class" in Composer\Autoload\{closure}() (line 38 of modules/xxxxxxxxxxxxx/src/Plugin/Oauth2Client/AuthCodeExample.php).

However using #[Oauth2Client( . . . the code . . . . )] (as from the Instagram example) works without throwing the class error.

The documentation and examples should not have the code which uses the " = " sign and @Oauth2Client(

AND . . . how does one delete the clients ??

In any event making changes to the file manually results in

Drupal\Component\Plugin\Exception\PluginNotFoundException: The "authcode_example" plugin does not exist. Valid plugin IDs for Drupal\oauth2_client\PluginManager\Oauth2ClientPluginManager are: resource_owner_example, authcode_access_example, authcode_redirect_example in Drupal\Core\Plugin\DefaultPluginManager->doGetDefinition() (line 53 of core/lib/Drupal/Component/Plugin/Discovery/DiscoveryTrait.php).

An attempt to use the clone feature in the pull down throws

TypeError: Cannot assign null to property Drupal\oauth2_client\Entity\Oauth2Client::$id of type string in Drupal\Core\Entity\EntityBase->createDuplicate() (line 373 of core/lib/Drupal/Core/Entity/EntityBase.php).

Need a big can of RAID here . . .

OK - that is where I started before this report, so I put the files back with edited urls - BEFORE - flushing the caches. The pic below shows the result - it worked and I got a "GET" not allowed error on my credentials. See second attached screenshot

The documentation shows the " * " comment frame removed for the "Instagram" access example - while it ony works leaving it in place. I renamed the files to single word titles as classes

You still did not say where does and how does the

$access_token = Drupal::service('oauth2_client.service')->getAccessToken($client_id);
$token = $access_token->getToken();

go in the code??

The documentation should be adjusted to show the proper order to edit the files before flushing the caches to seek discovery

I see the difference now between attribute and annotation. The examples are attribute, and the Instagram example is annotation.

I have edited the client form to include the CRID and MID.

It appears the client form only catches an error on failure to receive a token, so what about an optional "success" catch, so is there a log system as to token requests to know if it is working being sent tokens??

So does editing the file after discovery do NOTHING?

my "Code.php"file is below

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\StateTokenStorage;

/**
* Auth code
*
* @Oauth2Client(
* id = "code",
* name = @Translation("Code grant"),
* grant_type = "client_credentials",
* authorization_uri = "https://apis.usps.com/oauth2/v3/token",
* token_uri = "https://apis.usps.com/oauth2/v3/token",
* success_message = TRUE
* )
*/

class Code extends Oauth2ClientPluginBase {

/*
* This example assumes that the Drupal site is using a shared resource
* from a third-party service that provides a service to all uses of the site.
*
* Storing a single AccessToken in state for the plugin shares access to the
* external resource for ALL users of this plugin.
*/

use StateTokenStorage;

}

Thank you, but not frustrated. It simply appears that edits made to the file after discovery in fact do nothing. USPS has a funky Oauth2 implementation. I don't know where it uses it but the CRID and MID is needed before access is granted to the actual API. In the first client credentials the API example says

Prepare your credentials for use in the following examples:

CLIENT_ID=XXXX
CLIENT_SECRET=XXXX
CUSTOMER_REGISTRATION_ID=XXXX
MAILER_ID=XXXX

It is above in number 4 where I answer your question.

I tried editing the file after discovery to change the URLs called to but it kept going to mocklab.io

So if I change the file to remove the space line, I suspect it will do nothing unless I uninstall the Oauth2Client module to destroy the discovered plug-ins and re install and clear caches to cause discovery again

In the examples page from USPS the access grant shows the payload that comes back includes application name registered.

It does not show here but I had to add the application by name to my USPS developer account which is then associated with my client_ID, secret, CRID and MID sent of which the MID is a number associated with a mailing location. There can be many MID for each location but only one CRID. You can only get a developer account with a full business account linked to a bank account like for printing labels.

So I don't know, but it is possible no token would be sent without the CRID and MID.

The USPS Github page says:

"You will need to add an app in the API Developer Portal to get Consumer Key and Consumer Secret values. You will need a valid customer registration ID (CRID) and mailer ID (MID) in order to get an access token. "

The second pic I attached is a response into the browser from USPS where I used an "authorization code" grant type and it threw a no "GET" allowed error

So it worked to contact USPS for a Token which failed.

I changed it to "client credentials" in the file and there was no error thrown to the browser, but no message in the log either.

I duplicated the file, changed the name and class and re-discovered it and disabled the other and enabled the new one again the same, no error, but no message in the logs.

USPS will return a json payload even if it fails, so that is why my question on a catch on success or fail.

Renaming the client form to the original means the only way I would know is uninstall the Oauth2_client module and start with a fresh discovery.

That is why I asked how and if the plugins can be separately deleted.

So, no after uninstall and re-install and rediscover neither form gets a token registered in the log messages

There is another file which handles CURL calls against the USPS API which is where I had planned to use the $token call, but if I cannot get and store a token for access , that is moot.

I think this has to do with how the Oauth2Client code and Plugin handles json application payloads.

Is there a line of code I need to add or can add to the Plugin???

Are you saying to add the code from #11 to the plugin or elsewhere or is it already existing code elsewhere in the module ???

To the plugin throws

ParseError: syntax error, unexpected token "public", expecting end of file in Composer\Autoload\{closure}() (line 41 of /var/www/public_html/modules/xxxxxxxxxxxxxxx/src/Plugin/Oauth2Client/Auth2Code.php).
Severity Error

Removing "public" from the function allows it to run, but no message appears or is logged

As to the "scope" suggestion, it is my understanding until an initial token is obtained there is no API access and then the scope access request issues are then needed. The initial token is critical to moving forward at all. You cannot jump into scope issues at all.

Mine is waiting as

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Access\AccessResultInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginAccessInterface;
use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\TempStoreTokenStorage;

/**
* Access code
*
* @Oauth2Client(
* id = "authaccess",
* name = @Translation("Auth Access grant"),
* grant_type = "authorization_code",
* code = "$token",
* redirect_uri = "https://xxxxxxxxxxxxx.com/authorize",
* scope = "prices labels tracking",
* state = "nonce=abscdefg#",
* success_message = TRUE
* )
*/
class AuthAccess extends Oauth2ClientPluginBase implements Oauth2ClientPluginAccessInterface {

/*
* This example assumes that a user is authenticating against a third-party
* service to retrieve a token that Drupal can use to access resources on
* that user's behalf.
*/
use TempStoreTokenStorage;

/**
* {@inheritdoc}
*/
public function codeRouteAccess(AccountInterface $account): AccessResultInterface {
return AccessResult::allowedIfHasPermissions($account, ['access content']);
}

}

The USPS example was originally "code": "{{CODE}}", that I guessed "CODE" was the token I changed to code = "$token",

Of course without a $token there is no variable $token

Chamging the file and rebuilding the cache does not show up changes in the config page for me - only a fresh file and flushing caches to rediscover works.

Still is there anyway to delete those plugins separately??

Looks like I am going to need to try the actual USPS CURL examples through my other file which I know will catch the response errors to the log

I am just following the USPS examples of what they say is required. I have not removed urls - I copied the example from USPS. They know how they have setup the authorization flow, and I am only guessing the "code" I mentioned is the prior token received. The specification you linked tends to indicate the authorization server can be set up that way. So without knowing what "CODE" they say is required the access token it would never be granted, and only the client credentials authorization code file might work. After creating a new file and editing it to add the authorize url and then flushing the cache for a rediscovery, still nothing - no error and no sucess message either

USPS is not likely to support this oauth2client module use, so without something caught in the communication to analyze this will never work

I even buit a plugin to throw the "GET" not allowed error into the broweser and it does so on /authorize so communication to USPS is still going on correctly

Something has to be going on with JSON or I am not being sent a token payload at all. I will contact USPS support to see if there is a recommended way to test other than CURL while I set up to try the CURL examples anyway

The plan was to use the Oauth2Client module for token management purposes for access only, Otherwise yes I would need far too many plugins. My other file is set up for CURL calls that would handle the API calls. I would only need the initial client credentials for authcode file, and the access file, and a refresh file I have not built yet

This morning when backing out of the response from USPS thrown to the browser for the first time a Drupak message appeared

Updated oauth2 client Auth4Code token grant.

This is from the plugin I built to fail thrown in response to the url window of the browser

https://apis.usps.com//oauth2/v3/authorize?state=d42e366ad0b866095cee735...

I have not been able to reproduce that message

I believe I can hack together the initial token credential USPS example curl call using my config menu and a temporary postfield of client credentials grant type in the file that makes the API calls which should throw a response to the log

Then I will try the Simple oauth module - then I will contact USPS with questions.

When I was working on a oauth connect project with Stripe Connect I was able to throw responses to the browser which let troubleshooting find the problem in the initial request causing the failure of the return token.

Is there any way to change code in this module to temporarily throw all responses to the browser???

Thank you. It is working using Postman. It does not work sent as a header, only if credentials are sent in the body.

From what I can tell of the code, the request has no provision in Oauth2Client to be sent in the body

Also the "client credentials" is a POST request not a GET.

OK, thanks I will see what I can do in the client form with a for example

if ($grantType == 'client_credentials') {
$form['oauth2_client']['data in body'] = [
'#type' => 'checkbox',
'#title' => $this->t('Enabled'),
'#default_value' => $this->entity->point to the code needed(),
];

As needed et cetera and it will be a stretch to my skills to cobble together but there is other code helpful on the internet on the issue as it is a common problem one

However, you say this can be done in the plugin itself - I can see calling the files you mention in a "use" statement

I dont have \League\OAuth2\Client I have /league/oauth2-client/src/Provider in the vendor directory. The concern I have is the OAuth2\Client versus oauth2-client and the latest php library at https://github.com/thephpleague/oauth2-client/tree/master/src/Provider which I can see looks corrected by namespace.

So how are you saying to do this in the plugin itself ??? I am new to the world of plugins

It sounds like you are saying it sends a GET request first, which the server you say sends back a response and then this client software sends a POST. Well the first GET sent will cause a FAIL - period - there will be no further communication as USPS has set it up

If you look at the Example OAuth Client Credentials Token request on the USPS example page onb Github, there is one POST to the /token URL ad that is all - with the data sent in the body. That is what works, and all that works - so how is this module stopped from sending the intial GET request in favor of the POST wit the data in the body

OK, tired of this or is there no solution??

I came across a similar issue with client_credentials - but that poster wanting to send for authorization in the headers and not in the body at https://www.drupal.org/project/oauth2_client/issues/3384244. You wrote a solution there.

I am studying how I might modify that. It looks like the

* optionProvider = "\League\OAuth2\Client\OptionProvider\PostAuthOptionProvider",

might be useful, unless I am reading it incorrectly

I then discovered the client id and secret could be called in the plugin itself - like somethng as for a plugin as

/**
* Auth code
*
* @Oauth2Client(
* id = "auth7code",
* name = @Translation("Auth7Code token grant"),
* grant_type = "client_credentials",
* client_id = "$credentials['client_id']",
* client_secret = "$credentials['client_secret']",
* authorization_uri = "https://apis.usps.com//oauth2/v3/token",
* token_uri = "https://apis.usps.com/oauth2/v3/token",
* optionProvider = "\League\OAuth2\Client\OptionProvider\PostAuthOptionProvider",
* success_message = TRUE
* )
*/

In the code you wrote is these two lines

$options = parent::getAccessTokenOptions($method, $params);
$options['headers']['Authorization'] = 'Basic ' . $encodedCredentials;

I know $method is the variable for POST or GET, but I cannot find where it is set

and I know this second $options should in part be

$options['body']['Change to??'] = 'Change to ??' . $encodedCredentials;

If you do not want to assist further - I get it - but this is the way a POST should be sent for security as other locations on the web have said

Client credentials flow is all I have ever been seeking to get to work right now

Early I posted the screen capture of the reject if a GET request is made on /token

That piece of code I posted was my intention to program a switch case behind that menu selection but then you said it could be done by override in the Plugin. While asking how, I then found the issue where you wrote an override on a client credentials flow that I previously linked. I have never been talking about authorization flow, I have been saying I cannot go there until I get the client credentials token request working first. Then using that token I can gain access to the API in an access grant authorization flow.

You explained the issue here

"" I am describing the process for the authorization code flow and you are responding about the client credentials flow. This module will not send the client credentials token request, or any token request in a GET since I am not overriding the default in the upstream library.""

Yet it appears the "authorization code" grant type does send a "GET" because that is how the Plugin can throw the GET not allowed error into the browser on a call to /token endpoint and /authorize. It must be noted all of the USPS call are POST code requests.

So it sounds like you are now saying client credentials does not in the library send a GET request

If it sends POST that is great, but it needs to be sent in the BODY not the HEADER

A Basic Header Authorization will not work. There is no initial log in, just the POST as a client credentials grant with client ID and secret as a POST in the BODY as the USPS Curl example shows.

I do not know what you are talking about getting Oauth2 working with a reliable service. It already is working. Postman works perfectly with my credentials manually to USPS.

So does the client credentials flow send only a POST by default??? If so then the modification is only to send the data params in the body and not the header like the last thing I asked about the $options section I posted of the example using your previous code solution.

The form is the default and this is the plugin which fails

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\StateTokenStorage;

/**
* Auth code
*
* @Oauth2Client(
* id = "auth5code",
* name = @Translation("Auth5Code token grant"),
* grant_type = "client_credentials",
* authorization_uri = "https://apis.usps.com//oauth2/v3/token",
* token_uri = "https://apis.usps.com/oauth2/v3/token",
* success_message = TRUE
* )
*/
class Auth5Code extends Oauth2ClientPluginBase {

/*
* This example assumes that the Drupal site is using a shared resource
* from a third-party service that provides a service to all uses of the site.
*
* Storing a single AccessToken in state for the plugin shares access to the
* external resource for ALL users of this plugin.
*/

use StateTokenStorage;

}

I keep saying the client crendentials must be sent in the body - that is why it fails. They cannot be sent in the basic Authorization Header. My last stab at it above shows what I tried. Perhaps I called the client id and secret form variables wrong. But if sent in a header they will fail anyway - only are to be sent in the body

If this module does not send a GET then there is a bug because USPS replies with an error thrown to the browser on an attempt at an authorization_code grant saying it does because the GET is not allowed

A client credential fail throws no error - it just fails and hangs up on you no further info

See the attached Postman setup where "client crendentials sent in body" is selected and works

Thank you for this; however, it does not like

  /**
   * {@inheritdoc}
   */
  public function getProvider(): AbstractProvider {
    $provider = parent::getProvider();
    $provider->setOptionProvider(new UspsClientCredentialsOptionProvider($this));
    return $provider;
  }

In firefox it is just a blank white screen and in Chrome it say the site cannot handle the request

Remove the code and the site will come up

Enabled logging and rotated logs manually to clear the junk.

Initially the plugin was missing a use statement for AbstractProvider

I added both

use League\OAuth2\Client\Provider\AbstractProvider;
use League\OAuth2\Client\Provider\GenericProvider;

The plugin would enable and run then throwing (actually it enabled with only AbstractProvider)

League\OAuth2\Client\Provider\Exception\IdentityProviderException: invalid_request in League\OAuth2\Client\Provider\GenericProvider->checkResponse() (line 236 of /public_html/vendor/league/oauth2-client/src/Provider/GenericProvider.php)

with the following partial backtrace

#0 /public_html/vendor/league/oauth2-client/src/Provider/AbstractProvider.php(740): League\OAuth2\Client\Provider\GenericProvider->checkResponse(Object(GuzzleHttp\Psr7\Response), Array)
#1 /public_html/vendor/league/oauth2-client/src/Provider/AbstractProvider.php(646): League\OAuth2\Client\Provider\AbstractProvider->getParsedResponse(Object(GuzzleHttp\Psr7\Request))
#2 /public_html/modules/oauth2_client/src/Plugin/Oauth2GrantType/ClientCredentials.php(35): League\OAuth2\Client\Provider\AbstractProvider->getAccessToken(Object(League\OAuth2\Client\Grant\ClientCredentials), Array)
#3 /public_html/modules/oauth2_client/src/Plugin/Oauth2Client/Oauth2ClientPluginBase.php(297): Drupal\oauth2_client\Plugin\Oauth2GrantType\ClientCredentials->getAccessToken(Object(Drupal\xxxxxxxxxxxxxxx\Plugin\Oauth2Client\Auth99Code))
#4 /public_html/modules/oauth2_client/src/Service/Oauth2ClientService.php(44): Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase->getAccessToken(Object(Drupal\oauth2_client\OwnerCredentials))
#5 /public_html/modules/oauth2_client/src/Form/Oauth2ClientForm.php(330): Drupal\oauth2_client\Service\Oauth2ClientService->getAccessToken('auth99code', Object(Drupal\oauth2_client\OwnerCredentials))
#6 [internal function]: Drupal\oauth2_client\Form\Oauth2ClientForm->testToken(Array, Object(Drupal\Core\Form\FormState))
#7 /public_html/core/lib/Drupal/Core/Form/FormSubmitter.php(129): call_user_func_array(Array, Array)

Looks like a Guzzle issue, but why is it trying to call "OwnerCredentials" ???

That is what I last had in #24 calling by variable

Even using the actual text values it still throws

League\OAuth2\Client\Provider\Exception\IdentityProviderException: invalid_request in League\OAuth2\Client\Provider\GenericProvider->checkResponse() (line 236 of /public_html/vendor/league/oauth2-client/src/Provider/GenericProvider.php)

I believe it is continuing to send data in a header

My #24 example I said I likely called the client variables wrong. I did not look for an error in the code, I just do not see where it is put into or called into the body as a parameter. I see where it is done in reverse sort of in https://www.drupal.org/project/oauth2_client/issues/3384244

USPS support responded to me with this

""Please see explanations below for the individual fields in OAuth.
• Scope: Only specified if you wish to have access to specific APIs. If omitted, all APIs configured to your App will be in scope.
• Code: This is a merchants authorization code that is provided to customers by third party platforms. In your case, this can be omitted.
• Redirect URI: This is the merchants URL to their platform. In your case, this can be omitted.
• Grant Type: This will be the type of token you are requesting. In your case, please use client_credentials""

So it is "scope" and not "scopes" but does not go into a client_credentials grant request regardless

The production api example runs but shows no delivery of a token nor error tp the log or php error log while the test api example does not show in the plugin list at all. The production example throws nothing to the log

Since Drupal uses Guzzle and Guzzle uses Curl - is it possible to build a plugin that make a curl call directly using the example from USPS??

Until I get an initial access token, no other grant can be sought.

Yes thank you for all your hard work. In my #24 I zeroed in on the PostAuth file you mention. My belief was to override it for body not headers. If the $params has anything more than the id and secret as shown in the USPS example it will fail - possibly without comment response.

The file that makes the API calls for USPS in my module uses Curl directly.

The original plan was to modify it to make the token calls, but to do token management would re-create what Oauth2Client already does.

I last worked on Oauth2 in Drupal 7 on a Stripe Connect flow project, and was I believe a character in the header which caused this same kind of isdue

I am going to try some mods to the override, then building the client_credentials Plugin with my working curl code.

Since Postman works, I know the problem is in the extra parameters being possibly included and still being sent possibly also in the header.

Even the "Auth code" comment above the @0auth2Client code might cause it as well as the ID or name, so first I will strip everything but what is shown in the example from USPS.

I will report back later.

In setting up the simple oauth module the Rest_ui "sees" the Oauth2_client as this

OAuth2 Client (read-only) /entity/oauth2_client/{oauth2_client}: GET

AGAIN the "GET" issue appears, not a POST.

No, I do not have PHPStorm or Xdebug setup locally. I am running the tests directly on the server since they are harmless to just getting a oauth2_client flow going.

I am stopped unable to see where 'clientId`, `clientSecret`, `redirectUri`, is picked up and set equal the saved ' clientId`, `clientSecret`, to from the form

  $credentials = [
          'client_id' => $values['client_id'],
          'client_secret' => $values['client_secret'],

Because in AbstractProvider at line 634 it is defined as

$params = [
            'client_id'     => $this->clientId,
            'client_secret' => $this->clientSecret,
            'redirect_uri'  => $this->redirectUri,
        ];

The redirect uri is obviously called from the Plugin itself because it works to cast a rejection / fail

I had not worked on it for a few days

So if I change it to

$credentials = [
          'client_id' => $values['clientId'],
          'client_secret' => $values['clientSecret'],
        ];

and

in the form itself to

'#default_value' => $credentials['clientSecret'] ?? '', and
'#default_value' => $credentials['clientId'] ?? '',

will that interfere with other place in the module code??? I do not see it called anywhere else in the module, and this variable name will match the library

Thank you, but there is nothing wrong with MY Drupal site. I have been working with Drupal since version 6. I am not to the point of debugging MY code, this is the module code not working. Simple oauth works, curl works, Postman works, oauth2_client does not.

I am pointing out the upstream library calls "clientId" and "clientSecret" as variables in AbstractProvider so where in the Oauth2_client code is that set equal to "client_id" and "client_secret"???

This is not my code, this is the Oauth2_client Plugin which only needs three things but has more one which is the url we know is working.. The YouTube video has nothing to do with this issue. It is the $params not being sent in the function with $options causing the issue and how whether in the header or in the body.

I have debugged and discovered the request reaches USPS but is "invalid" as I do not see where and how it is sent in the body nor how the $params variable picks up "this->clientId " or "this->clientSecret" from the Oauth2_client module. Where does it exist set by the form in configFactory to be available for use by the upstream library???

Yes, thank you as that is how I read it BUT. where is the client_id and client_secret set from the form to clientId and clientSecret for.

$params = [
            'client_id'     => $this->clientId,
            'client_secret' => $this->clientSecret,

I do not see how values are passed by the Plugin without this variable declaration somewhere from the form values.

It also appears that this is still sent in a URL header string which will fail

And my point is NOWHERE is "clientId" and "clientSecret" declared or set equal to the form values "client_id" or "client_secret"

Thus it appears there is no value for "clientId" or "clientSecret" for the $params value to use but maybe "null"

There is a line that sets a string for use to send as a header but right now that above I have raised four times to no address

NOWHERE is "clientId" and "clientSecret" declared or set equal to the form values "client_id" or "client_secret" I can find nor have you said

When I mentioned modifying the form to save those values you said it not needed to be done

I see ok thanks. I will try a plugin built with curl calling clientId and clientSecret just as the USPS example shows. I found it in Oauth2ClientPluginBase all the way at the bottom along with a host of other things defined

I will contact USPS again and ask what throws an "invalid_request" response

The custom code you provided did not run until I added the AbstractProvider as a use statement, so I will add GenericProvider as a use statement also

USPS told me anything more than what the example shows sent in the client_credentials request will cause a fail as did the "authorization_code" fail with a "GET" error thrown to the URL window and the browser in my #10

I believe where I saw the string issue was in a question in a github support thread https://github.com/thephpleague/oauth2-client/issues/774#issuecomment-64...

Thank you. I added the function to two of the plugins, but the oath2_client logger is gone, so I went to uninstall and re-install the module

Not related to the function you provided, on uninstall the module throws this

Error: Call to a member function getPath() on null in Drupal\config_translation\ConfigNamesMapper->getOverviewRoute() (line 247 of core/modules/config_translation/src/ConfigNamesMapper.php).
Drupal\config_translation\Routing\RouteSubscriber->alterRoutes(Object) (Line: 37)
Drupal\Core\Routing\RouteSubscriberBase->onAlterRoutes(Object, 'routing.route_alter', Object)
call_user_func(Array, Object, 'routing.route_alter', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch(Object, 'routing.route_alter') (Line: 189)
Drupal\Core\Routing\RouteBuilder->rebuild() (Line: 83)
Drupal\Core\ProxyClass\Routing\RouteBuilder->rebuild() (Line: 558)
Drupal\Core\Extension\ModuleInstaller->uninstall(Array, 1) (Line: 91)
Drupal\Core\ProxyClass\Extension\ModuleInstaller->uninstall(Array) (Line: 182)
Drupal\system\Form\ModulesUninstallConfirmForm->submitForm(Array, Object)
call_user_func_array(Array, Array) (Line: 129)
Drupal\Core\Form\FormSubmitter->executeSubmitHandlers(Array, Object) (Line: 67)
Drupal\Core\Form\FormSubmitter->doSubmitForm(Array, Object) (Line: 597)
Drupal\Core\Form\FormBuilder->processForm('system_modules_uninstall_confirm_form', Array, Object) (Line: 326)
Drupal\Core\Form\FormBuilder->buildForm(Object, Object) (Line: 73)
Drupal\Core\Controller\FormController->getContentResult(Object, Object)
call_user_func_array(Array, Array) (Line: 123)

more

So right now - even though oauth2_client reinstalls - the entity is not seen. The php log shows

[12-Apr-2025 14:39:44] WARNING: [pool xxxxxxx.com] child 356802 said into stderr: "NOTICE: PHP message: Uncaught PHP Exception Drupal\Component\Plugin\Exception\PluginNotFoundException: "The "oauth2_client" entity type does not exist." at /var/www/xxxxxxxx/public_html/core/lib/Drupal/Core/Entity/EntityTypeManager.php line 142"

Did I put the function in the wrong place?? The plugin runs and enables without error, but the database logger does not show "oauth2_client" any longer either

It appears related to multi lingual config_translation.

It looks like

Could be caused by a module which doesn't provide a base path for a config entity, see for example:

https://www.drupal.org/project/dynamic_layouts/issues/3002255 https://www.drupal.org/project/password_policy/issues/2703717 https://www.drupal.org/project/paragraphs_entity_embed/issues/3014901 https://www.drupal.org/project/search_api/issues/2919676 https://www.drupal.org/project/salesforce/issues/3040022

All of these have patches for the issue

Still and yet somehow on re install no entity is created for oauth2_client

OK Thanks, so I wont uninstall it again. The multi-lingal config_translation causes that truncated uninstall.

Right now there is no oauth2_client logger filter in the Drupal log anymore

I can get the Access.php plugin to throw the "GET not allowed" error so I know that plug in is communicating with USPS

But no longer does the client credentials plugin do anything. It does not throw an error to the PHP error log,indicating an "invalid_request" showing it was communicating with USPS

I will need to work backwards to get back to at least that error to prove it is communicating and then try the most recent function you provided.

Currently this is the plugin below but not even show signs of life it is sending anything

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\StateTokenStorage;
use League\OAuth2\Client\Provider\AbstractProvider;
use League\OAuth2\Client\Provider\GenericProvider;

/**
 * @Oauth2Client(
 *   id = "auth909code",
 *   name = @Translation("Auth909Code token grant"),
 *   grant_type = "client_credentials",
 *   authorization_uri = "https://apis.usps.com//oauth2/v3/token",
 *   token_uri = "https://apis.usps.com/oauth2/v3/token",
 *   success_message = TRUE
 * )
 */
class Auth909Code extends Oauth2ClientPluginBase {
  /**
   * Creates a new provider object.
   *
   * @return \League\OAuth2\Client\Provider\GenericProvider
   *   The provider of the OAuth2 Server.
   */
  public function getProvider(): AbstractProvider {
    return new GenericProvider(
      [
        'clientId' => $this->getClientId(),
        'clientSecret' => $this->getClientSecret(),
        'urlAuthorize' => $this->getAuthorizationUri(),
        'urlAccessToken' => $this->getTokenUri(),
        'urlResourceOwnerDetails' => $this->getResourceUri(),
      ],
      $this->getCollaborators()
    );
  }

  use StateTokenStorage;

 }

The last communicating Plugin was from posts 33 to 35.

I have Devel installed. I added the ksm($response); where shown. Nothing outputs to the screen when the plugin is run

I restored the code you posted in #30, and it runs, communicates with USPS and gets the "invalid_request" response from USPS, but it too does not output to the screen, but does throw to the Drupal log under "oauth2_client" filter

I even tried

namespace Drupal\xxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\xxxxxxxxxxxxx\OAuth2\Client\OptionProvider\UspsClientCredentialsOptionProvider;
use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\StateTokenStorage;
use League\OAuth2\Client\Provider\AbstractProvider;
use League\OAuth2\Client\Provider\GenericProvider;

/**
 *
 * @Oauth2Client(
 *   id = "auth1999code",
 *   name = @Translation("Auth1999Code token grant"),
 *   grant_type = "client_credentials",
 *   authorization_uri = "https://apis.usps.com//oauth2/v3/token",
 *   token_uri = "https://apis.usps.com/oauth2/v3/token",
 *   success_message = TRUE
 * )
 */
class Auth1999Code extends Oauth2ClientPluginBase {

  use StateTokenStorage;

  /**
   * {@inheritdoc}
   */
  public function getProvider(): AbstractProvider {
    $provider =parent::getProvider();
    $provider->setOptionProvider(new UspsClientCredentialsOptionProvider($this));
    return new GenericProvider(
      [
        'clientId' => $this->getClientId(),
        'clientSecret' => $this->getClientSecret(),
        'urlAuthorize' => $this->getAuthorizationUri(),
        'urlAccessToken' => $this->getTokenUri(),
        'urlResourceOwnerDetails' => $this->getResourceUri(),
      ],
      $this->getCollaborators()
    );
    return $provider;
  }

 }

which runs without error, but no response

Something in the function code $this->getCollaborators() is it looks like causing no request to ever be sent

If I change the class to

class Auth1999Code extends Oauth2ClientPluginBase {

  use StateTokenStorage;

  /**
   * {@inheritdoc}
   */
  public function getProvider(): AbstractProvider {
    $provider =parent::getProvider();
    $provider->setOptionProvider(new UspsClientCredentialsOptionProvider($this));
    new GenericProvider(
      [
        'clientId' => $this->getClientId(),
        'clientSecret' => $this->getClientSecret(),
        'urlAuthorize' => $this->getAuthorizationUri(),
        'urlAccessToken' => $this->getTokenUri(),
        'urlResourceOwnerDetails' => $this->getResourceUri(),
      ],
      $this->getCollaborators()
    );
    return $provider;
  }

 }

It runs and returns the "invalid_request" error to the Drupal log messages under oauth2_client. That error can be anything and the USPS response will not indentify it other than contains "extra parameters" One such parameter is the scope not allowed in the client_credentials grant request

The UspsClientCredentialsOptionProvider you provided runs the request but contains code relating to scope which will cause the failure as "invalid_request". I used it because it ran to present at least the invalid_request response, but I do not know how to use it to not present the scope. You say in #34 it sends a scope parameter

I duplicated the AbstractProvider.php to AbstractProvider_php and modified the original by dropping in the new ksm code complete function. Nothing still is thrown to the screen

Example_api plugin named to UspsTestApi.php runs but throws no message to the screen or the Drupal log

The original file I mentioned still runs and throws the invalid_request to the Drupal log

"invalid_client" means as much as "invalid_request" - a connection that failed but the example api does not throw anything for me to the screen or the Drupal log

The #[ oauth2client ] method does not throw any message to the Drupal log. The @oauth2Client method does

UspsClientCredentialsOptionProvider.php is the only thing that appears to make a connection to USPS other than a naked plugin set to throw an error

I am not versed on this league oauth library, but I put the function you provided in UspsClientCredentialsOptionProvider.php and it runs and throws the same invalid request error with no description. I cannot see how the getProvider function does anything

One of the plugins complained about a syntax error and trapped me to an uninstall - re install scenario throwing the same config translation null error

I installed this patch and it points to this module routing.yml file as the source. https://www.drupal.org/files/issues/2020-05-26/drupal-3016131-23-useless...

My site is multi domain with domain access using Adaptive Theme which has generated themes and has done strange thing like this before. I am going to try changing the theme first, because at the very least the file that runs should output more info.

I will also ask USPS if a contractors developers id and secret is available. They said if my id and secret gets compromised they will issue another

There is a Drupal group - that meets regularly, but I do not thing they would be sophisticated enough to handle this - it is mainly newbies and one or two regulars who are not coders, but maintenance types

Looking at the status message, it appeared to be thrown to a terminal window so investigating the ksm command I discovered it is no longer a part of the Devel module. See https://www.drupal.org/project/devel_kint_extras/issues/3458022

It is now separate as the "devel-kint-extras" module. I have installed it but it appears also requires Kint also

It also appears that the override code prevents the http request - except in the case of uspsclientcredentials file which in returning "json" is making the http request

I would think fixing what is half working is better than starting over with non working override

The current file just needs to remove and block the scope in place of what this latest function is supposed to do according to # 66

I am talking about the files from #30 to be modified like what #66 was modified as an override to send. It was the last client that sends and gets a response

OK I got ksm working - it threw

Error: Object of class Drupal\kint\DrupalFieldableEntityPlugin could not be converted to string in array_diff() (line 19 of modules/devel_kint_extras/src/Plugin/Devel/Dumper/KintExtended.php).
Drupal\devel_kint_extras\Plugin\Devel\Dumper\KintExtended->configure() (Line: 31)
Drupal\devel\Plugin\Devel\Dumper\Kint->__construct(Array, 'kint', Array) (Line: 25)
Drupal\Core\Plugin\Factory\ContainerFactory->createInstance('kint', Array) (Line: 76)
Drupal\Component\Plugin\PluginManagerBase->createInstance('kint', Array) (Line: 62)
Drupal\devel\DevelDumperPluginManager->createInstance('kint') (Line: 97)
Drupal\devel\DevelDumperManager->createInstance('kint') (Line: 121)
Drupal\devel\DevelDumperManager->export('
{
"error": "invalid_request",
"error_description": "The Content-Type header is either missing or specifies a media type that is not supported.",
"error_uri": "https://datatracker.ietf.org/doc/html/rfc6749#page-45"
}
', NULL, 'kint', ) (Line: 129)
Drupal\devel\DevelDumperManager->message('
{
"error": "invalid_request",
"error_description": "The Content-Type header is either missing or specifies a media type that is not supported.",
"error_uri": "https://datatracker.ietf.org/doc/html/rfc6749#page-45"
}
', NULL, 'status', 'kint') (Line: 453)
ksm('
{
"error": "invalid_request",
"error_description": "The Content-Type header is either missing or specifies a media type that is not supported.",
"error_uri": "https://datatracker.ietf.org/doc/html/rfc6749#page-45"
}
') (Line: 737)
League\OAuth2\Client\Provider\AbstractProvider->getParsedResponse(Object) (Line: 646)
League\OAuth2\Client\Provider\AbstractProvider->getAccessToken(Object, Array) (Line: 35)
Drupal\oauth2_client\Plugin\Oauth2GrantType\ClientCredentials->getAccessToken(Object) (Line: 297)
Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase->getAccessToken(Object) (Line: 44)
Drupal\oauth2_client\Service\Oauth2ClientService->getAccessToken('auth999code', Object) (Line: 330)
Drupal\oauth2_client\Form\Oauth2ClientForm->testToken(Array, Object)
call_user_func_array(Array, Array) (Line: 129)

... more

This was from a plugin of this structure

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\xxxxxxxxxxx\OAuth2\Client\OptionProvider\UspsClientCredentialsOptionProvider;
use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\StateTokenStorage;
use League\OAuth2\Client\Provider\AbstractProvider;
use League\OAuth2\Client\Provider\GenericProvider;

/**
 *
 * @Oauth2Client(
 *   id = "auth999code",
 *   name = @Translation("Auth999Code token grant"),
 *   grant_type = "client_credentials",
 *   authorization_uri = "https://apis.usps.com//oauth2/v3/token",
 *   token_uri = "https://apis.usps.com/oauth2/v3/token",
 *   success_message = TRUE
 * )
 */
class Auth999Code extends Oauth2ClientPluginBase {

  use StateTokenStorage;

  /**
   * {@inheritdoc}
   */
  public function getProvider(): AbstractProvider {
    $provider =parent::getProvider();
    $provider->setOptionProvider(new UspsClientCredentialsOptionProvider($this));
    return $provider;
  }

 }

which is the code structure from #30 and Drupal\xxxxxxxxxxx\OAuth2\Client\OptionProvider\UspsClientCredentialsOptionProvider
is

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxx\OAuth2\Client\OptionProvider;

use Drupal\oauth2_client\OAuth2\Client\OptionProvider\ClientCredentialsOptionProvider;
use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginInterface;

/**
 * An option provider which alters the token request content type.
 */
class UspsClientCredentialsOptionProvider extends ClientCredentialsOptionProvider {

  /**
   * Creates a new provider object.
   *
   * @return \League\OAuth2\Client\Provider\GenericProvider
   *   The provider of the OAuth2 Server.
   */
  public function getProvider(): AbstractProvider {
    return new GenericProvider(
      [
        'clientId' => $this->getClientId(),
        'clientSecret' => $this->getClientSecret(),
        'urlAuthorize' => $this->getAuthorizationUri(),
        'urlAccessToken' => $this->getTokenUri(),
        'urlResourceOwnerDetails' => $this->getResourceUri(),
      ],
      $this->getCollaborators()
    );
  }

  /**
   * A string of scopes imploded from the Oauth2ClientPlugin.
   */
  private string $scopeOption;

  /**
   * {@inheritdoc}
   */
  public function __construct(Oauth2ClientPluginInterface $clientPlugin) {
    $scopes = $clientPlugin->getScopes();
    if (!empty($scopes)) {
      $this->scopeOption = implode($clientPlugin->getScopeSeparator(), $scopes);
    }
  }

  /**
   * {@inheritdoc}
   */
  public function getAccessTokenOptions($method, array $params): array {
    if (!empty($this->scopeOption)) {
      $params['scope'] = $this->scopeOption;
    }
    return ['json' => $params];
  }

}

whidh I admit is hacked up code that I did just to throw something of a more detailed response; however the original unaltered code from #30 throws the same thing

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxxxxx\OAuth2\Client\OptionProvider;

use Drupal\oauth2_client\OAuth2\Client\OptionProvider\ClientCredentialsOptionProvider;
use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginInterface;

/**
 * An option provider which alters the token request content type.
 */
class UspsClientCredentialsOptionProvider extends ClientCredentialsOptionProvider {


  /**
   * A string of scopes imploded from the Oauth2ClientPlugin.
   */
  private string $scopeOption;

  /**
   * {@inheritdoc}
   */
  public function __construct(Oauth2ClientPluginInterface $clientPlugin) {
    $scopes = $clientPlugin->getScopes();
    if (!empty($scopes)) {
      $this->scopeOption = implode($clientPlugin->getScopeSeparator(), $scopes);
    }
  }

  /**
   * {@inheritdoc}
   */
  public function getAccessTokenOptions($method, array $params): array {
    if (!empty($this->scopeOption)) {
      $params['scope'] = $this->scopeOption;
    }
    return ['json' => $params];
  }

}

The straight example edited with no override as

<?php

declare(strict_types=1);

namespace Drupal\xxxxxxxxxxxxxxxxxx\Plugin\Oauth2Client;

use Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase;
use Drupal\oauth2_client\Plugin\Oauth2Client\StateTokenStorage;

/**
 * Auth code 
 *
 * @Oauth2Client(
 *   id = "authcode",
 *   name = @Translation("AuthCode token grant"),
 *   grant_type = "client_credentials",
 *   authorization_uri = "https://apis.usps.com/oauth2/v3/token",
 *   token_uri = "https://apis.usps.com/oauth2/v3/token",
 *   success_message = TRUE
 * )
 */
class AuthCode extends Oauth2ClientPluginBase {

  /*
   * This example assumes that the Drupal site is using a shared resource
   * from a third-party service that provides a service to all uses of the site.
   *
   * Storing a single AccessToken in state for the plugin shares access to the
   * external resource for ALL users of this plugin.
   */

  use StateTokenStorage;

 }

actually works throwing (three identical)

Error: Object of class Drupal\kint\DrupalFieldableEntityPlugin could not be converted to string in array_diff() (line 19 of modules/devel_kint_extras/src/Plugin/Devel/Dumper/KintExtended.php).
Drupal\devel_kint_extras\Plugin\Devel\Dumper\KintExtended->configure() (Line: 31)
Drupal\devel\Plugin\Devel\Dumper\Kint->__construct(Array, 'kint', Array) (Line: 25)
Drupal\Core\Plugin\Factory\ContainerFactory->createInstance('kint', Array) (Line: 76)
Drupal\Component\Plugin\PluginManagerBase->createInstance('kint', Array) (Line: 62)
Drupal\devel\DevelDumperPluginManager->createInstance('kint') (Line: 97)
Drupal\devel\DevelDumperManager->createInstance('kint') (Line: 121)
Drupal\devel\DevelDumperManager->export('
{
    "access_token": "eyJraWQiOiJIdWpzX2F6UnFJUzBpSE5YNEZIRk96eUwwdjE4RXJMdjNyZDBoalpNUnJFIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJlbnRpdGxlbWVudHMiOlt7Im5hbWUiOiJGQVNUIiwiY3JpZHMiOiIxNjg3OTczMiJ9XSwic3ViIjoiNzc5MDEzNTIiLCJjcmlkIjoiMTY4Nzk3MzIiLCJzdWJfaWQiOiI3NzkwMTM1MiIsInJvbGVzIjpbXSwicGF5bWVudF9hY2NvdW50cyI6eyJhY2NvdW50cyI6IjEwMDAwNDAyMTYsIDEwMDAwNDAyMzgsIDEwMDAwNDA0MDMsIDEwMDAwNDA0MDQsIDEwMDAwMzkzNzIifSwiaXNzIjoiaHR0cHM6Ly9rZXljLnVzcHMuY29tL3JlYWxtcy9VU1BTIiwiY29udHJhY3RzIjp7InBheW1lbnRBY2NvdW50cyI6eyJhY2NvdW50cyI6IjEwMDAwNDAyMTYsIDEwMDAwNDAyMzgsIDEwMDAwNDA0MDMsIDEwMDAwNDA0MDQsIDEwMDAwMzkzNzIifSwicGVybWl0cyI6W3sicGVybWl0TnVtYmVyIjoiOTA0NiIsInBlcm1pdFpJUCI6IjIwMjYwMDg0NiJ9XX0sImF1ZCI6WyJwYXltZW50cyIsInByaWNlcyIsInN1YnNjcmlwdGlvbnMtdHJhY2tpbmciLCJvcmdhbml6YXRpb25zIl0sImF6cCI6IjAxUnpQN3VaNFY1MzN3YlY4VWtjY1BWUmFURlVHdm8wajlIdDRyc2Iyd1dzMGhmQSIsIm1haWxfb3duZXJzIjpbeyJjcmlkIjoiMTY4Nzk3MzIiLCJtaWRzIjoiOTAxNjEzNTUyLCA5MDE2MTM0MzcifV0sInNjb3BlIjoiZG9tZXN0aWMtcHJpY2VzIGFkZHJlc3NlcyBpbnRlcm5hdGlvbmFsLXByaWNlcyBzZXJ2aWNlLXN0YW5kYXJkcyBsb2NhdGlvbnMgc2hpcG1lbnRzIiwiY29tcGFueV9uYW1lIjoiV0lMQkVSIFVOSU9OICAgREJBIEhQQyBNQU5VRkFDVFVSSU5HIiwiZXhwIjoxNzQ1MTE3MjAwLCJpYXQiOjE3NDUwODg0MDAsImp0aSI6ImU5MGQxN2EyLTgyYzgtNDM4NC1iYTEwLWFhYmE4ZTUyMjgyMSJ9.l4byyKP2Gr-2k7bfgNplyMQKJetPtvRd9Qm-rFRyIlX8uR35WKoYLxjDEWCe67DeaSuxiEWAef4JYgpsCasqvZTGJm-A32krJ_dEIUWTA1rpqrkPQunOg663eAFrGOTGyx85accJ_tKef_QeJplQfQIlpLDptojhBYVDW5dJoqKk9P_GPQw5tci-JRrgriEZolOjgXzgFKAltNvgzzbE90705RvG4bUOFE9ssPNqM2nZVzYuLE0N0Hd35w0SVRPzGQwEfi8oUkaxnHN0T8EIfyFNRFpADmK5jS1MatnZX-0H6FYpI7u3zwjlGgZPQU0EoCJwgKxyOAmmfrpumRqHXg",
    "token_type": "Bearer",
    "issued_at": 1745088400109,
    "expires_in": 28799,
    "status": "approved",
    "scope": "domestic-prices addresses international-prices service-standards locations shipments",
    "issuer": "https://keyc.usps.com/realms/USPS",
    "client_id": "xxxxxxxxxxxxxxxxxx",
    "application_name": "xxxxxxxxxxxxxxxxxxxx",
    "api_products": "[Public Access I]",
    "public_key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF1UjQzS0hRdm44UlYybWplMEczSAptKzI3dnA4ZFh4U25oQTVrSk5VbFVJTmZaYnBtZGR6VWpaV1RRMHU0SWdMaTQ5ZDJlTTR1TVE2NjFNdmNyUE5ZCktvRXBWRkNldzJ5QmhqUjJ0T3A5V0gwODgxQ0x3RWdTY3p6YU4vNDAxQ3BSSXlVTjh1aHVuV29ydzZSdkI2S0oKY1NRaFUyMkVrZ0hpZ3ZJTVpDWGt2dmlaa1ByeWI1cTJIcGtMNjVCcFdBRHBYSklpMGJFaXdFU1RSbm9qdkdZSAp3TXJvOCtwVGdmNEN1ZXdpbTdFaDluNm1nbmZnTWp5MUprcjZVVTUzWU1ZdWRrZzB0NHBUb1QvZWd0MHJjZCtwCjJURk82NG9uU21XRDlyWXh1Q0xwYVcwTG1GVGoyYUpTOUt3TnhHb2pIakV5TjhIVG5zd1lOKzdQNVlLVmxobHUKL1FJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t"
}
        ', NULL, 'kint', ) (Line: 129)
Drupal\devel\DevelDumperManager->message('
{
    "access_token": "eyJraWQiOiJIdWpzX2F6UnFJUzBpSE5YNEZIRk96eUwwdjE4RXJMdjNyZDBoalpNUnJFIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJlbnRpdGxlbWVudHMiOlt7Im5hbWUiOiJGQVNUIiwiY3JpZHMiOiIxNjg3OTczMiJ9XSwic3ViIjoiNzc5MDEzNTIiLCJjcmlkIjoiMTY4Nzk3MzIiLCJzdWJfaWQiOiI3NzkwMTM1MiIsInJvbGVzIjpbXSwicGF5bWVudF9hY2NvdW50cyI6eyJhY2NvdW50cyI6IjEwMDAwNDAyMTYsIDEwMDAwNDAyMzgsIDEwMDAwNDA0MDMsIDEwMDAwNDA0MDQsIDEwMDAwMzkzNzIifSwiaXNzIjoiaHR0cHM6Ly9rZXljLnVzcHMuY29tL3JlYWxtcy9VU1BTIiwiY29udHJhY3RzIjp7InBheW1lbnRBY2NvdW50cyI6eyJhY2NvdW50cyI6IjEwMDAwNDAyMTYsIDEwMDAwNDAyMzgsIDEwMDAwNDA0MDMsIDEwMDAwNDA0MDQsIDEwMDAwMzkzNzIifSwicGVybWl0cyI6W3sicGVybWl0TnVtYmVyIjoiOTA0NiIsInBlcm1pdFpJUCI6IjIwMjYwMDg0NiJ9XX0sImF1ZCI6WyJwYXltZW50cyIsInByaWNlcyIsInN1YnNjcmlwdGlvbnMtdHJhY2tpbmciLCJvcmdhbml6YXRpb25zIl0sImF6cCI6IjAxUnpQN3VaNFY1MzN3YlY4VWtjY1BWUmFURlVHdm8wajlIdDRyc2Iyd1dzMGhmQSIsIm1haWxfb3duZXJzIjpbeyJjcmlkIjoiMTY4Nzk3MzIiLCJtaWRzIjoiOTAxNjEzNTUyLCA5MDE2MTM0MzcifV0sInNjb3BlIjoiZG9tZXN0aWMtcHJpY2VzIGFkZHJlc3NlcyBpbnRlcm5hdGlvbmFsLXByaWNlcyBzZXJ2aWNlLXN0YW5kYXJkcyBsb2NhdGlvbnMgc2hpcG1lbnRzIiwiY29tcGFueV9uYW1lIjoiV0lMQkVSIFVOSU9OICAgREJBIEhQQyBNQU5VRkFDVFVSSU5HIiwiZXhwIjoxNzQ1MTE3MjAwLCJpYXQiOjE3NDUwODg0MDAsImp0aSI6ImU5MGQxN2EyLTgyYzgtNDM4NC1iYTEwLWFhYmE4ZTUyMjgyMSJ9.l4byyKP2Gr-2k7bfgNplyMQKJetPtvRd9Qm-rFRyIlX8uR35WKoYLxjDEWCe67DeaSuxiEWAef4JYgpsCasqvZTGJm-A32krJ_dEIUWTA1rpqrkPQunOg663eAFrGOTGyx85accJ_tKef_QeJplQfQIlpLDptojhBYVDW5dJoqKk9P_GPQw5tci-JRrgriEZolOjgXzgFKAltNvgzzbE90705RvG4bUOFE9ssPNqM2nZVzYuLE0N0Hd35w0SVRPzGQwEfi8oUkaxnHN0T8EIfyFNRFpADmK5jS1MatnZX-0H6FYpI7u3zwjlGgZPQU0EoCJwgKxyOAmmfrpumRqHXg",
    "token_type": "Bearer",
    "issued_at": 1745088400109,
    "expires_in": 28799,
    "status": "approved",
    "scope": "domestic-prices addresses international-prices service-standards locations shipments",
    "issuer": "https://keyc.usps.com/realms/USPS",
    "client_id": "xxxxxxxxxxxxxxxxxx",
    "application_name": "xxxxxxxxxxxxxxxxxxxx",
    "api_products": "[Public Access I]",
    "public_key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF1UjQzS0hRdm44UlYybWplMEczSAptKzI3dnA4ZFh4U25oQTVrSk5VbFVJTmZaYnBtZGR6VWpaV1RRMHU0SWdMaTQ5ZDJlTTR1TVE2NjFNdmNyUE5ZCktvRXBWRkNldzJ5QmhqUjJ0T3A5V0gwODgxQ0x3RWdTY3p6YU4vNDAxQ3BSSXlVTjh1aHVuV29ydzZSdkI2S0oKY1NRaFUyMkVrZ0hpZ3ZJTVpDWGt2dmlaa1ByeWI1cTJIcGtMNjVCcFdBRHBYSklpMGJFaXdFU1RSbm9qdkdZSAp3TXJvOCtwVGdmNEN1ZXdpbTdFaDluNm1nbmZnTWp5MUprcjZVVTUzWU1ZdWRrZzB0NHBUb1QvZWd0MHJjZCtwCjJURk82NG9uU21XRDlyWXh1Q0xwYVcwTG1GVGoyYUpTOUt3TnhHb2pIakV5TjhIVG5zd1lOKzdQNVlLVmxobHUKL1FJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t"
}
        ', NULL, 'status', 'kint') (Line: 453)
ksm('
{
    "access_token": "eyJraWQiOiJIdWpzX2F6UnFJUzBpSE5YNEZIRk96eUwwdjE4RXJMdjNyZDBoalpNUnJFIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJlbnRpdGxlbWVudHMiOlt7Im5hbWUiOiJGQVNUIiwiY3JpZHMiOiIxNjg3OTczMiJ9XSwic3ViIjoiNzc5MDEzNTIiLCJjcmlkIjoiMTY4Nzk3MzIiLCJzdWJfaWQiOiI3NzkwMTM1MiIsInJvbGVzIjpbXSwicGF5bWVudF9hY2NvdW50cyI6eyJhY2NvdW50cyI6IjEwMDAwNDAyMTYsIDEwMDAwNDAyMzgsIDEwMDAwNDA0MDMsIDEwMDAwNDA0MDQsIDEwMDAwMzkzNzIifSwiaXNzIjoiaHR0cHM6Ly9rZXljLnVzcHMuY29tL3JlYWxtcy9VU1BTIiwiY29udHJhY3RzIjp7InBheW1lbnRBY2NvdW50cyI6eyJhY2NvdW50cyI6IjEwMDAwNDAyMTYsIDEwMDAwNDAyMzgsIDEwMDAwNDA0MDMsIDEwMDAwNDA0MDQsIDEwMDAwMzkzNzIifSwicGVybWl0cyI6W3sicGVybWl0TnVtYmVyIjoiOTA0NiIsInBlcm1pdFpJUCI6IjIwMjYwMDg0NiJ9XX0sImF1ZCI6WyJwYXltZW50cyIsInByaWNlcyIsInN1YnNjcmlwdGlvbnMtdHJhY2tpbmciLCJvcmdhbml6YXRpb25zIl0sImF6cCI6IjAxUnpQN3VaNFY1MzN3YlY4VWtjY1BWUmFURlVHdm8wajlIdDRyc2Iyd1dzMGhmQSIsIm1haWxfb3duZXJzIjpbeyJjcmlkIjoiMTY4Nzk3MzIiLCJtaWRzIjoiOTAxNjEzNTUyLCA5MDE2MTM0MzcifV0sInNjb3BlIjoiZG9tZXN0aWMtcHJpY2VzIGFkZHJlc3NlcyBpbnRlcm5hdGlvbmFsLXByaWNlcyBzZXJ2aWNlLXN0YW5kYXJkcyBsb2NhdGlvbnMgc2hpcG1lbnRzIiwiY29tcGFueV9uYW1lIjoiV0lMQkVSIFVOSU9OICAgREJBIEhQQyBNQU5VRkFDVFVSSU5HIiwiZXhwIjoxNzQ1MTE3MjAwLCJpYXQiOjE3NDUwODg0MDAsImp0aSI6ImU5MGQxN2EyLTgyYzgtNDM4NC1iYTEwLWFhYmE4ZTUyMjgyMSJ9.l4byyKP2Gr-2k7bfgNplyMQKJetPtvRd9Qm-rFRyIlX8uR35WKoYLxjDEWCe67DeaSuxiEWAef4JYgpsCasqvZTGJm-A32krJ_dEIUWTA1rpqrkPQunOg663eAFrGOTGyx85accJ_tKef_QeJplQfQIlpLDptojhBYVDW5dJoqKk9P_GPQw5tci-JRrgriEZolOjgXzgFKAltNvgzzbE90705RvG4bUOFE9ssPNqM2nZVzYuLE0N0Hd35w0SVRPzGQwEfi8oUkaxnHN0T8EIfyFNRFpADmK5jS1MatnZX-0H6FYpI7u3zwjlGgZPQU0EoCJwgKxyOAmmfrpumRqHXg",
    "token_type": "Bearer",
    "issued_at": 1745088400109,
    "expires_in": 28799,
    "status": "approved",
    "scope": "domestic-prices addresses international-prices service-standards locations shipments",
    "issuer": "https://keyc.usps.com/realms/USPS",
    "client_id": "xxxxxxxxxxxxxxxxxx",
    "application_name": "xxxxxxxxxxxxxxxxxx",
    "api_products": "[Public Access I]",
    "public_key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF1UjQzS0hRdm44UlYybWplMEczSAptKzI3dnA4ZFh4U25oQTVrSk5VbFVJTmZaYnBtZGR6VWpaV1RRMHU0SWdMaTQ5ZDJlTTR1TVE2NjFNdmNyUE5ZCktvRXBWRkNldzJ5QmhqUjJ0T3A5V0gwODgxQ0x3RWdTY3p6YU4vNDAxQ3BSSXlVTjh1aHVuV29ydzZSdkI2S0oKY1NRaFUyMkVrZ0hpZ3ZJTVpDWGt2dmlaa1ByeWI1cTJIcGtMNjVCcFdBRHBYSklpMGJFaXdFU1RSbm9qdkdZSAp3TXJvOCtwVGdmNEN1ZXdpbTdFaDluNm1nbmZnTWp5MUprcjZVVTUzWU1ZdWRrZzB0NHBUb1QvZWd0MHJjZCtwCjJURk82NG9uU21XRDlyWXh1Q0xwYVcwTG1GVGoyYUpTOUt3TnhHb2pIakV5TjhIVG5zd1lOKzdQNVlLVmxobHUKL1FJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t"
}
        ') (Line: 734)
League\OAuth2\Client\Provider\AbstractProvider->getParsedResponse(Object) (Line: 646)
League\OAuth2\Client\Provider\AbstractProvider->getAccessToken(Object, Array) (Line: 35)
Drupal\oauth2_client\Plugin\Oauth2GrantType\ClientCredentials->getAccessToken(Object) (Line: 297)
Drupal\oauth2_client\Plugin\Oauth2Client\Oauth2ClientPluginBase->getAccessToken(Object) (Line: 44)
Drupal\oauth2_client\Service\Oauth2ClientService->getAccessToken('authcode', Object) (Line: 330)

But as what started this, nothing is found in the Drupal message log and no oauth2_client filter is present

I will do some work on authorization code grant next trying to call this / the token before expiration but right now authorization_code grant throws

<code>{
  "fault": {
    "faultstring": "OASValidation OpenAPI-Spec-Validation-OAuth2 with resource \"oas://oauth2-3_0_2.yaml\": failed with reason: \"[ERROR - GET operation not allowed on path '/token'.: []]\"",
    "detail": {
      "errorcode": "steps.oasvalidation.Failed"
    }
  }
}

So apparently it always has worked but no message of getting the token was ever placed anywhere to inform of success as you stated is supposed to occur

I have not been able to pull and print it from token storage however

Thank you but following your #48 the last thing you say is

"If JSON is returned it is parsed and turned into an AccessToken object. Otherwise errors are thrown."

But since there is no error nor success message and I cannot retrieve it, it must not be getting either parsed or stored.

Is there a way to call and print to the screen what is stored???

It appears StateTokenStorage is empty

None of this is my code.

There is no success message nor error, so what proof is the token is stored?

I used

$access_token = Drupal::service('oauth2_client.service')->getAccessToken($client_id);
$token = $access_token->getToken();

To try to inspect or print $token