I'm building an ASP.NET Core application that integrates with Facebook to exchange a short-lived token for a long-lived token.

When making the request, I keep receiving the following error:

StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers: { WWW-Authenticate: OAuth "Facebook Platform" "invalid_code" "Invalid verification code format." }

Code:

var httpClient = \_httpClientFactory.CreateClient();

var queryParameters = new Dictionary\<string, string\>
{
{ "client_id", clientId },
{ "redirect_uri", redirectUri },
{ "client_secret", clientSecret },
{ "state", companyId },
{ "code", authorizationCode }
};

var queryString = string.Join("&", queryParameters.Select(kvp =\>
$"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(kvp.Value)}"));

var urlWithParams = $"{FacebookTokenUrl}?{queryString}";

var tokenResponse = await httpClient.GetAsync(urlWithParams);

What does the error "Invalid verification code format" mean? The code is returned by FB Service while login in on front-end.

Could this issue be related to Business Verification or App Access Verification requirements in Facebook?

I'm building an ASP.NET Core application that integrates with Facebook to exchange a short-lived token for a long-lived token.

When making the request, I keep receiving the following error:

StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers: { WWW-Authenticate: OAuth "Facebook Platform" "invalid_code" "Invalid verification code format." }

Code:

var httpClient = \_httpClientFactory.CreateClient();

var queryParameters = new Dictionary\<string, string\>
{
{ "client_id", clientId },
{ "redirect_uri", redirectUri },
{ "client_secret", clientSecret },
{ "state", companyId },
{ "code", authorizationCode }
};

var queryString = string.Join("&", queryParameters.Select(kvp =\>
$"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(kvp.Value)}"));

var urlWithParams = $"{FacebookTokenUrl}?{queryString}";

var tokenResponse = await httpClient.GetAsync(urlWithParams);

What does the error "Invalid verification code format" mean? The code is returned by FB Service while login in on front-end.

Could this issue be related to Business Verification or App Access Verification requirements in Facebook?

• asp-core
• oauth
• access-token
• facebook-login

• The code should be found here https://your-redirect-uri/?code=AUTHORIZATION_CODE&state=STATE. Could you share more details, so that we can verify the code, thanks. – Jason Pan Commented Jan 20 at 11:46
• Since we don't know how you get the code, could you share your sample code about that, many thanks – Jason Pan Commented Jan 20 at 12:01

1 Answer 1

In which phase of the OAuth protocol flow are at the stage you are mentioning? The token request you've shared doesn't specify the grant_type parameter. So perhaps this is missing, and therefore the authorization server can't handle the authorization code.