Can I pass custom data with the Access Token Request (OAuth v2)?

Question

Hey everyone 👋I’m implementing oauth2 authentication with the Zapier Platform UI, and I can’t figure out how to access custom query parameters in the “Add OAuth v2 Endpoint Configuration” step.The framework that I use for oauth2 requires every access token request to have a code verifier, which is just a huge string. I pass this as a “code_verifier” param along with the “code” and “state” in the Zapier redirect URL:https://zapier.com/dashboard/auth/oauth/return/App170464CLIAPI/?code=TSyXifW95nFZb3bgInuVLVsA2GBLgS2xKAP2zoLP&code_verifier=OUFMQklKVDg4VlNKQThURldDQkhUU0MyR0lCREVOT1A4MVU2V1FHME1JSTFWSVNPSQ==&state=1666972916.326372427372I can then access the code params from bundle.inputData.code. But when I try to use bundle.inputData.code_verifier I get an empty string (same with every custom param):I’ve found a quick workaround for now: I combine both values into one huge string separated by “AND”, and put them into the “code” param. Then I use split(“AND”) method:It works, but it’s definitely not the cleanest solution :) I wonder if I can just access the code_verifier directly.

iansco · Accepted Answer

Hi @Elis Gubarev,So if understand correctly, the code verifier isn’t meant to be passed openly via query parameters? If so, I think the best approach would be to remove PKCE from my auth flow until Zapier adds native support for PKCE.No, not in the way that it’s being passed here, i.e. from the authentication server to the client (Zapier). When PKCE is supported, Zapier will generate the code-verifieron our end as the “client” in the flow:https://www.oauth.com/oauth2-servers/pkce/authorization-request/...the code verifier is passed to Zapier as a query parameter in Zapier’s redirect URLThank you for the confirmation. Could you try usingbundle.cleanedRequest.querystring to see if the parameter is made available there, as per our example app:https://github.com/zapier/zapier-platform/blob/master/example-apps/oauth2/authentication.js#L13Related help docs:https://platform.zapier.com/docs/advanced#rawrequest-and-cleanedrequest

iansco · Answer

Hi @Elis Gubarev!👋It works, but it’s definitely not the cleanest solution :) I wonder if I can just access the code_verifier directly.Based onthecode_verifier reference, does theauthorization server usePKCE?Ifso, Zapier doesn’t yet havebuilt-in support for OAuth 2 authorization code flow with PKCE, I’m sorry about that🙁PKCE supportis something we’re working on but we don’t have a timeline on when itwill become available.Although the approach you’re usingenablessuccessful authentication, it seems this approach might circumventthe security that PKCE is intended to provide, as per the details in this post:While I haven’t been able to find any record of someone successfully implementing PKCE support, that mightbe possible if you build an integration using the Zapier Developer CLI as it will give you more control over authentication and access to morefunctionality:If the authorization server isn’t actually using PKCE, please could you confirm wherecode_verifier comes from? For example, is it returned by the authorization server as a querystring parameter/value when it makes a request to Zapier’s redirect URL?Thanks!

Sign up

Use your Zapier credentials

Log in to the Community

Use your Zapier credentials

Scanning file for viruses.

This file cannot be downloaded