Hosted OAuth token exchange returns invalid_authentication in Sandbox

General Discussion
1

Hello,

I’m using a US Sandbox application with Hosted OAuth.

The Google authorization step completes successfully and returns to my registered callback. However, the token exchange at POST /v3/connect/token consistently returns:

Status: 400
Type: invalid_authentication
Message: Invalid credentials provided
Request ID: 128185131-fa3d75e4-a597-4eaa-a230-243610eea9fe

The JSON request includes:

  • client_id
  • a newly generated API key as client_secret
  • grant_type: authorization_code
  • code
  • the exact same registered redirect_uri
  • code_verifier: nylas

I have revoked the previous key, generated a new one, updated the server secret and restarted the OAuth flow. The error remains unchanged.

Could someone confirm whether this Sandbox application/API key association is valid or whether there is an issue with Hosted OAuth token exchange?

No API keys, authorization codes, grant IDs or personal information are included.

2

Hello. Our Support team has reached out to you via email to continue this investigation. Please check your mailbox for our message.