PayPal API获取Token正常但其他端点授权失败求助

原本用JavaScript实现的PayPal API测试版本可正常运行，转为Curl在服务器端执行（用于隐藏凭证）后，能成功获取Access Token，但调用其他所有端点时均出现授权失败。

相关Curl命令及返回结果如下：

获取Token的命令及成功返回 #

curl https://api.sandbox.paypal.com/v1/oauth2/token \
 -H 'Accept: application/json' \
 -H 'Accept-Language: en_US' \
 -u 'XXXCLIENT_IDXXX':'XXXSECRETXXX' \
 -d grant_type=client_credentials

返回结果：

$VAR1 = {
          'app_id' => 'APP-80W284485P519543T',
          'scope' => 'https://uri.paypal.com/services/invoicing https://uri.paypal.com/services/disputes/read-buyer https://uri.paypal.com/services/payments/realtimepayment https://uri.paypal.com/services/disputes/update-seller https://uri.paypal.com/services/payments/payment/authcapture openid https://uri.paypal.com/services/disputes/read-seller https://uri.paypal.com/services/payments/refund https://api.paypal.com/v1/vault/credit-card https://api.paypal.com/v1/payments/.* https://uri.paypal.com/payments/payouts https://api.paypal.com/v1/vault/credit-card/.* https://uri.paypal.com/services/subscriptions https://uri.paypal.com/services/applications/webhooks',
          'expires_in' => 32329,
          'token_type' => 'Bearer',
          'nonce' => '2023-10-09T15:32:55Zhrzfg_lRlbaSCIW8HMlnO5rV1Yp_MQ4TKGag2B8zoBw',
          'access_token' => 'A21AAIZFjd0g3gpxiHckR1s60mg17K8GtlcvypfSxzKxWAFBFpeqM7t_8XdifcV1RRBwUvFeExF_OgKU2-PWxGS0oZeLDZ4-Q'
        };

调用发票端点的命令及错误返回 #

curl -v -X POST https://api.sandbox.paypal.com/v2/invoicing/invoices  \
-H 'Authorization : Bearer A21AAIZFjd0g3gpxiHckR1s60mg17K8GtlcvypfSxzKxWAFBFpeqM7t_8XdifcV1RRBwUvFeExF_OgKU2-PWxGS0oZeLDZ4-Q' \
-H 'Content-Type: application/json' \
-H 'Prefer: return=representation' \
-d '{
....
}'

返回结果：

$VAR1 = {
          'message' => 'Authentication failed due to invalid authentication credentials or a missing Authorization header.',
          'links' => [
                       {
                         'rel' => 'information_link',
                         'href' => 'https://developer.paypal.com/docs/api/overview/#error'
                       }
                     ],
          'name' => 'AUTHENTICATION_FAILURE'
        };

原因及解决方法 #

问题出在Authorization请求头的键名里多了一个空格：你写的是Authorization :（冒号前带空格），而正确的HTTP请求头格式要求键名不能包含空格，正确写法应为Authorization: Bearer ...（冒号前无空格，冒号后可带一个空格）。

服务器会严格匹配请求头的键名，带空格的Authorization 会被识别为一个完全无关的请求头，导致PayPal无法找到有效的授权信息，因此返回AUTHENTICATION_FAILURE。

修正后的Authorization头写法：

-H 'Authorization: Bearer A21AAIZFjd0g3gpxiHckR1s60mg17K8GtlcvypfSxzKxWAFBFpeqM7t_8XdifcV1RRBwUvFeExF_OgKU2-PWxGS0oZeLDZ4-Q'

额外排查点（若修正后仍报错） #

• 确认Access Token未过期：返回的expires_in为有效期秒数，确保调用其他端点时Token仍在有效期内。
• 确认Token权限范围：返回的scope需包含目标端点所需权限（本次案例中https://uri.paypal.com/services/invoicing已包含，此点无问题）。
• 检查Curl命令的其他细节：比如端点URL是否正确、请求体JSON格式是否合法。

内容的提问来源于stack exchange，提问作者Eddie Rowe