# Server:9000/token returns 400 response

**URL:** <https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414>\
**Category:** V5 Question\
**Created:** [May 1, 2018, 10:27pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414 "2018-05-01T22:27:04Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 1, 2018, 10:27pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/1 "2018-05-01T22:27:04Z")

</div>

I am working to integrate our web ordering system with SambaPOS.

I have installed SambaPOS and message server using a SQL server express database for the SambaPOS database.

I was following the tutorial “Integrator’s GraphQL API Guide” located at [Integrator's GraphQL API Guide](https://forum.sambapos.com/t/integrators-graphql-api-guide/14047/3) and was using Postman to send the request “[http://192.168.1.16:9000/token](http://192.168.1.16:9000/token)” to get a Authorization / access\_token.

I get an http 400 Bad Request from the message server.

The form fields in the request are…

grant\_type: password  
username: Administrator  
password: 1234  
client\_id: graphql  
client\_secret: test

SambaPOS is set up with these parameters as per the turtoial. The turtoial is using version 5.1.62 and I am using version 5.2.3 and I don’t know if this would make a difference.

The content in the response is

{  
“error”: “invalid\_clientId”,  
“error\_description”: “ClientId should be sent.”  
}

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![QMcKay](https://forum.sambapos.com/user_avatar/forum.sambapos.com/qmckay/32/27925_2.png) [@QMcKay](https://forum.sambapos.com/u/QMcKay)\
**Post date:** [May 1, 2018, 10:37pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/2 "2018-05-01T22:37:31Z")

</div>

The client\_id is the Application Identifier. Have you created an Application in SambaPOS? Create an application other than the “graphql” app (it should be used for GraphiQL only)

Are you sure you are using the Password and not the PIN? Only the Password will work, PINs do not.

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 2, 2018, 5:01am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/3 "2018-05-02T05:01:33Z")

</div>

I tried different values for the client\_id / identifier. I am sure I am using the Password and not the PIN

What can I do to trouble shoot this problem?

---

<div class="post-metadata">

**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\
**Post date:** [May 2, 2018, 12:19pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/4 "2018-05-02T12:19:33Z")

</div>

Did you create the Application?

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 2, 2018, 2:53pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/5 "2018-05-02T14:53:16Z")

</div>

What is the process to “create the Application”?

In the SambaPOS interface I did the following

Manage-\>Users-\>Applications-\>Add Application  
Application Name: testql  
Identifier: testql  
Authentication Type: User Name & Password  
Authorization Type: All Functions in Local Network  
Lifetime: 365  
Allowed Origin: \*  
Active: True

I then added Permissions

After I saved, I can see the new application in the application list. What else is required to create an application?

---

<div class="post-metadata">

**Author:** ![QMcKay](https://forum.sambapos.com/user_avatar/forum.sambapos.com/qmckay/32/27925_2.png) [@QMcKay](https://forum.sambapos.com/u/QMcKay)\
**Post date:** [May 2, 2018, 9:19pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/6 "2018-05-02T21:19:59Z")

</div>

If you create a new Application or a new User, be sure to restart the MessagingServer service.

Make sure you are using your new client\_id of “testql” in your App.

At first, for the Application definition, don’t use a Secret, don’t restrict to Local Network, and don’t select Permissions.

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 2, 2018, 11:00pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/7 "2018-05-02T23:00:44Z")

</div>

I understand the MessagingServer must be restarted after User or Application changes in SambaPOS interface.

I am not sure exactly what you are referring to with the term “App”. Does an App only consist of the form fields that can be edited in SambaPOS Manage-\>Users-\>Applications-\>Add Application

or is there other code I need to write. Maybe some javascript?

---

<div class="post-metadata">

**Author:** ![QMcKay](https://forum.sambapos.com/user_avatar/forum.sambapos.com/qmckay/32/27925_2.png) [@QMcKay](https://forum.sambapos.com/u/QMcKay)\
**Post date:** [May 2, 2018, 11:36pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/8 "2018-05-02T23:36:19Z")

</div>

> [@rgarcia350](#):
>
> what you are referring to with the term “App”

> [@rgarcia350](#):
>
> I am working to integrate our web ordering system with SambaPOS.

That ^ is your “App”.

> [@rgarcia350](#):
>
> using Postman

That ^ is an “App”.

Whatever you are using, Postman for testing, or in your Web Ordering system, you are working with an “App” that is trying to connect to SambaPOS, specifically to the Messaging Server.

Postman is good to test with, for your Authorization Login. After you get that working, yes you will need to write some Javascript into your Web system to get Authorized, and subsequently run GQL queries and mutations.

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 3, 2018, 1:00am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/9 "2018-05-03T01:00:48Z")

</div>

I think I understand. My “App” will be a windows service running on our web server. How do I get the Server:9000/token request to return an access token so I can access the graphql api?

---

<div class="post-metadata">

**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\
**Post date:** [May 3, 2018, 1:49am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/10 "2018-05-03T01:49:45Z")

</div>

Take a look at the sample apps see how they did it.

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 3, 2018, 1:53am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/11 "2018-05-03T01:53:26Z")

</div>

I have followed the examples but all i get is a 400 response from the [http://192.168.1.16:9000/token](http://192.168.1.16:9000/token) post or get from my app

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 3, 2018, 1:54am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/12 "2018-05-03T01:54:15Z")

</div>

{  
“error”: “invalid\_clientId”,  
“error\_description”: “ClientId should be sent.”  
}

---

<div class="post-metadata">

**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\
**Post date:** [May 3, 2018, 2:16am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/13 "2018-05-03T02:16:03Z")

</div>

So show your code so we can see.

---

<div class="post-metadata">

**Author:** ![Jesse](https://forum.sambapos.com/user_avatar/forum.sambapos.com/jesse/32/61493_2.png) [@Jesse](https://forum.sambapos.com/u/Jesse)\
**Post date:** [May 3, 2018, 2:22am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/14 "2018-05-03T02:22:00Z")

</div>

Here is how the Gloria food app handles it. Ignore most of the parameters but look at the authorize portion.

```auto
}
script.js

var express = require('express');
var request = require('request');
var querystring = require('querystring');
var app = express();

var messageServer = 'localhost';
var messageServerPort = 9000;
var gloriaFoodKey = 'KEY_HERE';
var serverKey = 'KEY_HERE';
var timeout = 30000;
var customerEntityType = 'Customers';
var itemTagName = 'Gloria Name';
var ticketType = 'Delivery Ticket';
var departmentName = 'Restaurant';
var userName = 'Administrator';
var terminalName = 'Server';
var printJobName = 'Print Orders to Kitchen Printer';
var additionalPrintJobs = []; // array of additional print job names
var miscProductName = 'Misc';
var deliveryFeeCalculation = 'Delivery Service';
var tipCalculation = 'Tip';
var accessToken = undefined;
var accessTokenExpires = '';

function Authorize(callback) {
    accessToken = undefined;
    var form = { grant_type: 'client_credentials', client_secret: serverKey, client_id: 'gloria' };
    var formData = querystring.stringify(form);
    var contentLength = formData.length;

    request({
        headers: {
            'Content-Length': contentLength,
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        uri: 'http://' + messageServer + ':' + messageServerPort + '/Token',
        body: formData,
        method: 'POST'
    }, function (err, res, body) {
        if (err) {
            console.log('Error while trying to authorize >', err.message);
            if (callback) callback();
        }
        else if (res.statusCode === 400) {
            console.log(body);
            if (callback) callback();
        }
        else {
            var result = JSON.parse(body);
            accessToken = result.access_token;
            accessTokenExpires = new Date(result['.expires']);
            if (callback) callback();
        }
    });
}

```

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 3, 2018, 2:25am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/15 "2018-05-03T02:25:21Z")

</div>

Is it possible to get an access token from a postman request?

Isn’t an access token / Authorization key required to gain access to the GQL endpoints?

---

<div class="post-metadata">

**Author:** ![rgarcia350](https://forum.sambapos.com/letter_avatar_proxy/v4/letter/r/b4bc9f/32.png) [@rgarcia350](https://forum.sambapos.com/u/rgarcia350)\
**Post date:** [May 3, 2018, 2:52am UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/16 "2018-05-03T02:52:47Z")

</div>

I figured it out. I was not urlencoding the request form data…Thanks for your help

---

<div class="post-metadata">

**Author:** ![Ozan\_Manav](https://forum.sambapos.com/user_avatar/forum.sambapos.com/ozan_manav/32/28906_2.png) [@Ozan\_Manav](https://forum.sambapos.com/u/Ozan_Manav)\
**Post date:** [June 23, 2018, 12:32pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/17 "2018-06-23T12:32:55Z")

</div>

I get the same error, can the parameter name be wrong?

---

<div class="post-metadata">

**Author:** ![Ozan\_Manav](https://forum.sambapos.com/user_avatar/forum.sambapos.com/ozan_manav/32/28906_2.png) [@Ozan\_Manav](https://forum.sambapos.com/u/Ozan_Manav)\
**Post date:** [June 23, 2018, 12:36pm UTC](https://forum.sambapos.com/t/server-9000-token-returns-400-response/17414/18 "2018-06-23T12:36:14Z")

</div>

I have found the problem and you need to do the content type in as follows when post processing on the post man.

![image](https://forum.sambapos.com/uploads/default/original/3X/1/d/1d5158405d4d7af56f9abd156382d909c30a0149.png)  
 ![image](https://forum.sambapos.com/uploads/default/original/3X/d/4/d42b0de91182318dfb376504d3b866514da142d4.png)