# HELP: Unable to request bearer token (401) \[VB\]

**URL:** <https://opendataforum.transport.nsw.gov.au/t/help-unable-to-request-bearer-token-401-vb/96>\
**Category:** Uncategorized\
**Created:** [April 25, 2016, 9:28am UTC](https://opendataforum.transport.nsw.gov.au/t/help-unable-to-request-bearer-token-401-vb/96 "2016-04-25T09:28:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesc](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jamesc](https://opendataforum.transport.nsw.gov.au/u/jamesc)\
**Post date:** [April 25, 2016, 9:28am UTC](https://opendataforum.transport.nsw.gov.au/t/help-unable-to-request-bearer-token-401-vb/96/1 "2016-04-25T09:28:19Z")

</div>

Hi there,

I’m new to this whole API business and I’m trying to implement it into a school project. I have no issues using the bearer token, but more so in obtaining it. I have followed the tutorial at [https://opendata.transport.nsw.gov.au/site/en\_us/gs-api-basics.html](https://opendata.transport.nsw.gov.au/site/en_us/gs-api-basics.html), but have been unable to do the POST command.

I’m developing in [VB.Net](http://VB.Net) and have had no problems with using GET to actually fetch data from the API using a bearer token, but for some reason when I try to POST for the bearer I get “The remote server returned an error: (401) Unauthorized.” Now I have done the confidential and scope settings like the tutorial has stated and I’m sure my token is correct, but for some reason I keep getting the 401. Currently, I’m just using the opendata website to generate a bearer token but it expires and it’s a pain to generate another one manually. Here’s the code (this isn’t the real problem at the moment):

```
    Dim requests As HttpWebRequest
    Dim response As HttpWebResponse
    requests = CType(WebRequest.Create(https://xxx:yyy@api.transport.nsw.gov.au/auth/oauth/v2/token?grant_type=client_credentials&scope=user), HttpWebRequest)
    requests.ContentLength = 0
    requests.Method = "POST"
    Dim requeststream As Stream = requests.GetRequestStream
    response = CType(requests.GetResponse(), HttpWebResponse)
    Return New StreamReader(response.GetResponseStream()).ReadToEnd

```

I then tried to use some REST clients on chrome (Postman and Advanced Rest Client) to try do the POST. The command looks like: [https://xxxxx:yyyyy@api.transport.nsw.gov.au/auth/oauth/v2/token?grant\_type=client\_credentials&scope=user](https://xxxxx:yyyyy@api.transport.nsw.gov.au/auth/oauth/v2/token?grant_type=client_credentials&scope=user) (same as in the tutorial). The advanced REST client shows this as the source message:

POST /auth/oauth/v2/token?grant\_type=client\_credentials&scope=user  
HOST api.transport.nsw.gov.au  
content-length: 0

For the response, I receive:  
{  
“error”: “invalid\_client”  
“error\_description”: “The given client credentials were not valid”  
}

Now, I know the credentials are valid, so I guess it’s something to do with the POST cause it loses the @. I’m not really familiar with this API business so I have absolutely no idea especially when it comes to more cURL commands. Any assistance would be greatly appreciated! Cheers

---

<div class="post-metadata">

**Author:** ![timbennett](https://sea1.discourse-cdn.com/flex019/user_avatar/opendataforum.transport.nsw.gov.au/timbennett/32/226_2.png) [@timbennett](https://opendataforum.transport.nsw.gov.au/u/timbennett)\
**Post date:** [April 26, 2016, 6:19am UTC](https://opendataforum.transport.nsw.gov.au/t/help-unable-to-request-bearer-token-401-vb/96/2 "2016-04-26T06:19:05Z")

</div>

If it doesn’t work on Postman I’m guessing it’s not a VB issue, then. Did you [follow the instructions on this page](https://opendata.transport.nsw.gov.au/site/en_us/gs-intro.html)? Specifically:

- Set a callback URL
- Set scope to user
- Set application type to confidential

---

<div class="post-metadata">

**Author:** ![jamesc](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jamesc](https://opendataforum.transport.nsw.gov.au/u/jamesc)\
**Post date:** [April 27, 2016, 1:49pm UTC](https://opendataforum.transport.nsw.gov.au/t/help-unable-to-request-bearer-token-401-vb/96/3 "2016-04-27T13:49:29Z")

</div>

Thanks for your reply!

I can confirm that those were already set. I have since resolved the issue by moving the key and secret into the header instead of having them in the notation that the guide suggests. This seems to only apply to certain applications… Oh well.

Cheers

---

<div class="post-metadata">

**Author:** ![jxeeno](https://sea1.discourse-cdn.com/flex019/user_avatar/opendataforum.transport.nsw.gov.au/jxeeno/32/210_2.png) [@jxeeno](https://opendataforum.transport.nsw.gov.au/u/jxeeno)\
**Post date:** [April 27, 2016, 1:56pm UTC](https://opendataforum.transport.nsw.gov.au/t/help-unable-to-request-bearer-token-401-vb/96/4 "2016-04-27T13:56:18Z")

</div>

> [@jamesc](#):
>
> I have since resolved the issue by moving the key and secret into the header instead of having them in the notation that the guide suggests.

Ahh strange… so it works using `Authorization: Basic [b64 encoded API key/secret combination]`?