Postman可后台刷新Xero OAuth2令牌，但Python requests请求失败求助

问题描述 #

在尝试刷新Xero的OAuth2 Bearer令牌时返回400 Bad Request错误，需了解Postman刷新令牌时传递的请求头，以便复用到Python的requests函数中。以下是当前出错代码：

import requests

token_endpoint = "https://identity.xero.com/connect/token"
client_id = "YourClientID"
refresh_token = "YourRefreshToken"

payload = {
    "grant_type": "refresh_token",
    "client_id": client_id,
    "refresh_token": refresh_token
}

response = requests.post(token_endpoint, data=payload)

if response.status_code == 200:
    token_data = response.json()
    new_access_token = token_data.get("access_token")
    new_refresh_token = token_data.get("refresh_token")
    print("Access token refreshed successfully:", new_access_token)
    print("New refresh token:", new_refresh_token)
else:
    print("Failed to refresh access token. Status code:",response.status_code)

Postman刷新令牌的核心请求头 #

• Content-Type: application/x-www-form-urlencoded（OAuth2令牌端点强制要求，Postman发送表单数据时自动添加）
• User-Agent: Postman客户端标识（如PostmanRuntime/7.32.3，多数场景不影响，部分服务会做校验）
• Authorization（仅保密客户端需要）: Basic <Base64编码的client_id:client_secret>，用于客户端身份校验

代码错误排查与修正 #

根据Xero PKCE流程规范，刷新令牌时需注意两个关键问题：

1. 部分场景下requests默认的Content-Type头可能出现编码异常，需显式指定
2. 若你的应用是保密客户端（拥有client_secret），必须添加Authorization头做身份校验

修正代码1：公开客户端（无client_secret） #

import requests

token_endpoint = "https://identity.xero.com/connect/token"
client_id = "YourClientID"
refresh_token = "YourRefreshToken"

payload = {
    "grant_type": "refresh_token",
    "client_id": client_id,
    "refresh_token": refresh_token
}

# 显式指定符合要求的Content-Type头
headers = {
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.post(token_endpoint, data=payload, headers=headers)

if response.status_code == 200:
    token_data = response.json()
    new_access_token = token_data.get("access_token")
    new_refresh_token = token_data.get("refresh_token")
    print("Access token refreshed successfully:", new_access_token)
    print("New refresh token:", new_refresh_token)
else:
    print("Failed to refresh access token. Status code:", response.status_code)
    # 打印错误详情，定位具体问题
    print("Error details:", response.text)

修正代码2：保密客户端（有client_secret） #

import requests
import base64

token_endpoint = "https://identity.xero.com/connect/token"
client_id = "YourClientID"
client_secret = "YourClientSecret"
refresh_token = "YourRefreshToken"

payload = {
    "grant_type": "refresh_token",
    "client_id": client_id,
    "refresh_token": refresh_token
}

# 生成Basic Auth校验头
auth_str = f"{client_id}:{client_secret}"
auth_base64 = base64.b64encode(auth_str.encode("utf-8")).decode("utf-8")

headers = {
    "Content-Type": "application/x-www-form-urlencoded",
    "Authorization": f"Basic {auth_base64}"
}

response = requests.post(token_endpoint, data=payload, headers=headers)

if response.status_code == 200:
    token_data = response.json()
    new_access_token = token_data.get("access_token")
    new_refresh_token = token_data.get("refresh_token")
    print("Access token refreshed successfully:", new_access_token)
    print("New refresh token:", new_refresh_token)
else:
    print("Failed to refresh access token. Status code:", response.status_code)
    print("Error details:", response.text)

额外提示 #

• 打印response.text可获取Xero返回的具体错误信息（如invalid_client、invalid_refresh_token），是排查400错误的核心依据
• 确保refresh_token未过期、且与当前client_id对应

内容的提问来源于stack exchange，提问作者BTKCODEDEV