I have the following problem with the simple_oauth module.

  1. I can get the initial jwt token with a POST request to /oauth/token with the following form data:

    username: user
    password: password
    client_id: xxxx
    client_secret: yyy
    scope: oauth
    grant_type: password
  2. This token has the actual access token and the refresh token. So I have an interceptor in Angular to refresh the token when we get a 403 return code. The call to refresh the token is again a POST request to /oauth/token with a slightly different payload:

    client_id: xxxx
    client_secret: yyy
    scope: oauth
    grant_type: refresh_token
    refresh_token: def5020092674bfb5c570c518c112fbc78ec6ddb2d...
  3. This call also succeeds but when I try to use the returned token I will get 403 returns. It is like the tokens produced using one grant type or the other have different scopes...

Have you experienced this problem? Do you know what can I do to solve it? Thank you very much in advance.

  • I use type grant_type = client_credentials... but is what you're getting giving you two tokens... the access and the refresh. Wanted to check you are using the correct refresh token. You should be able to set a high "don't expire" limit and test with postman. Ensure things work there before implementing in Angular. Also, if you're using Angular, is grant_type password the recommended method for OAuth2? It used to be 'implicit', but people are moving to other things (see oauth.net/2/grant-types/implicit)
    – eahonet
    Oct 14, 2019 at 15:50
  • One thing I've noticed, as I'm having a similar problem (and I appreciate this post is about 4 years old) is the scopes when you make a call to refresh the token are null/empty. I'm not sure why that might be. Did you ever resolve this problem?
    – welly
    Aug 4, 2023 at 12:52

1 Answer 1


Status code 403 (Forbidden) does not mean that you are not properly authenticated. Since you received all tokens properly you are authenticated successfully. 401 Unauthorized means that you do not have a proper token, i.e. you are not authenticated).

If you receive 403 then you simply are not allowed to access the requested resource with the token you presented. The account you used does not have access privilege for whatever you are trying to access.

If I would have to guess:

  1. Either you used the wrong account (e.g. Stage account used on Production) => use the correct account
  2. Your account was not set up to access the endpoint. => talk to whoever created the account

Edit: It comes down to "Authentication != Authorization" ("who am I" vs. "what am I allowed to do").

  • Your point is completely valid, but the problem is... how can I be allowed with the original token and not allowed with the refresh one? Maybe there is some specific right in Drupal to be activated...
    – yeyeyerman
    Nov 3, 2019 at 20:35
  • Just to clarify: First you get the initial set of tokens which allow you to do X. When using the access token yields an "401 Unauthorized" you get a new set via the refresh token. When using the new access token to do X you get a "403 Forbidden"? Nov 5, 2019 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.