DocuSign invalid_grant错误咨询：授权码与令牌请求异常

First, let's recap your current flow to make sure we're aligned:

1. You're pulling an authorization code via this GET request:

   https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature&client_id=1590cb04-f976-4b54-897d-157f5a711ed0&state=x39pm23rtf23&redirect_uri=https://dev.coplsaas.com.au/brokerdev/webservice/whservice/getdscode
   

2. Then you're sending a POST to /oauth/token with Basic auth, but keep getting an invalid_grant error.

Let's break down the most likely causes and how to check each one:

• Expired or reused authorization code
  DocuSign's authorization codes are short-lived (only 2 minutes) and single-use. If you waited too long to exchange the code, or tried reusing it after a failed attempt, you'll get this error. Fix: Grab a fresh authorization code and send the token request immediately—don't delay.

• Mismatched redirect URI
  The redirect_uri in your token POST request must be an exact match to the one you used in the initial GET request. Even tiny differences (like a missing trailing slash, http vs https, or a typo in the domain) will trigger invalid_grant. Double-check that every character of the URI matches in both steps.

• Incorrect Basic auth header
  The Basic auth value is generated by base64-encoding the string {your_client_id}:{your_client_secret}. If your client secret is wrong, or the base64 encoding is messed up (extra spaces, missing characters, etc.), this will fail. Verify your client secret matches what's in your DocuSign developer account, then re-encode the pair properly (you can use an online base64 tool to cross-check).

• Environment/credential mismatch
  You're using the demo environment (account-d.docusign.com) for both steps, which is correct—but make sure your client ID and secret are also from the demo account, not production. Using production credentials in the demo environment (or vice versa) will definitely throw this error.

• Scope inconsistency
  Your initial request uses the signature scope—ensure your token request isn't asking for a different scope that your app isn't authorized for. The scope in the token request should match (or be a subset of) what you used to get the authorization code.

• Revoked user consent
  If the user whose account you're authenticating revoked consent for your app after you obtained the authorization code, exchanging the code will fail. Have the user go through the authentication flow again to grant fresh consent.

A quick debugging tip: Use a tool like Postman to replicate the token request with a brand-new authorization code. This helps you rule out any code implementation issues and focus on configuration problems.

内容的提问来源于stack exchange，提问作者nwzhaider