使用R语言调用Prosper.com OAuth 2.0 API遇权限拒绝问题求助

Let's break down what's causing your "Access Denied" error and get your Prosper API authentication working in R.

First, here's your context: you translated a working Python OAuth snippet to R but keep hitting a forbidden error. Let's start with the code you're working with, then fix the issues.

Original Working Python Code #

import requests
url = "https://api.prosper.com/v1/security/oauth/token"
payload = "grant_type=password&client_id=<your_client_id>&client_secret=<your_client_secret>&username=<prosper_account_username>&password=<prosper_account_password>"
headers = { 'accept': "application/json", 'content-type': "application/x-www-form-urlencoded" }
response = requests.request("POST", url, data=payload, headers=headers)
print(response.text)

Your R Code (With Error) #

# Required Libraries
library(httr)
library(jsonlite)
# All API access information
Prosper_Base_Address <- "https://api.prosper.com/v1"
Request_URL <- "https://api.prosper.com/v1/security/oauth/token"
ClientID_Username <- "<prosper api key>"
ClientSecret_Password <- "<prosper api secret>"
Prosper_Account_Username <- "<username>"
Prosper_Account_Password <- "<password>"
headers <- fromJSON('{ "accept": "application/json", "content-type": "application/x-www-form-urlencoded" }')
payload <- "grant_type=password&client_id=ClientID_Username&client_secret=ClientSecret_Password&username=Prosper_Account_Username&password=Prosper_Account_Password"
# Create the endpoints
prosper_endpoints <- oauth_endpoint(NULL, "authorize", "accessToken", base_url = "https://api.prosper.com/v1/security/oauth/token")
# Create the request app
prosper_app <- oauth_app("prosper_endpoints", key = ClientID_Username, secret = ClientSecret_Password)
# Get OAuth 2.0 credentials
prosper_token <- oauth2.0_token(prosper_endpoints, prosper_app, config_init = headers, user_params = payload)

When running this, you get:

{ "error" : "Forbidden", "error_description" : "Access Denied" }

What's Wrong Here? #

There are two critical issues:

1. Your payload isn't using real credentials: The payload string has literal variable names like ClientID_Username instead of inserting the actual values you stored in those variables. The API is seeing text like "ClientID_Username" instead of your actual API key—no wonder it's denying access!
2. You're overcomplicating the OAuth flow: Prosper's password grant type doesn't need httr's full oauth2.0_token() workflow. Your Python code makes a simple POST request with form data, and that's exactly what you should replicate in R.

Fixed R Code #

Here's a corrected version that mirrors your working Python code directly:

# Load required libraries
library(httr)
library(jsonlite)

# Replace these with your actual credentials
client_id <- "<your_client_id>"
client_secret <- "<your_client_secret>"
prosper_username <- "<prosper_account_username>"
prosper_password <- "<prosper_account_password>"

# Token endpoint URL
token_url <- "https://api.prosper.com/v1/security/oauth/token"

# Set up headers (native R list is simpler than parsing JSON)
headers <- list(
  accept = "application/json",
  `content-type` = "application/x-www-form-urlencoded"  # Backticks handle the hyphen
)

# Prepare form data as a list (httr will encode it correctly)
payload <- list(
  grant_type = "password",
  client_id = client_id,
  client_secret = client_secret,
  username = prosper_username,
  password = prosper_password
)

# Send the POST request
response <- POST(token_url, headers = headers, body = payload, encode = "form")

# Handle the response
if (http_status(response)$category == "Success") {
  # Parse and print the token data
  token_data <- fromJSON(content(response, "text"))
  print(token_data)
} else {
  # Print error details if something goes wrong
  cat("Error:", content(response, "text"), "\n")
}

Key Fixes Explained #

• Proper credential substitution: Using a list for payload ensures your actual credentials are passed to the API, not just variable names. The encode = "form" argument tells httr to format the data correctly as application/x-www-form-urlencoded, just like Python's requests does.
• Simplified headers: We use a native R list instead of parsing JSON—this is more efficient and avoids any parsing issues. The backticks around content-type are necessary because R doesn't allow hyphens in variable names without them.
• Direct POST request: Instead of using oauth2.0_token(), we call POST() directly. This matches the straightforward approach of your Python code and aligns with how Prosper expects the password grant type to be used.

Extra Troubleshooting Tips #

• Double-check all credentials for typos or extra spaces—even a single wrong character will cause an access error.
• Confirm that your Prosper API credentials are allowed to use the password grant type. Some providers restrict this grant to specific use cases, so you might need to check your API settings.
• If you've made multiple failed attempts, your IP might be temporarily blocked. Wait a few minutes or reach out to Prosper support if the issue persists.

内容的提问来源于stack exchange，提问作者johnakwei