I always get The requested redirect URL is not permitted error

[mohsenr1]

Hey guys. I am developing a WordPress plugin that works with Etsy API and I always get the following error at first place after authentication:

An error occurred
The requested redirect URL is not permitted.

I actually already added the correct Callback URL to my account. I'm using startz/oauth2-etsy package. Here is my code:

// Define plugin constants (replace with YOUR actual values)
define('ETSY_KEY_STRING', 'XXXXXXXXXXXXXXXXXXXXXX');
define('ETSY_SHARED_SECRET', 'XXXXXXXXX');
define('ETSY_REDIRECT_URI', 'https://mydomain.com/etsy-products/');


require 'vendor/autoload.php'; 

    $provider = new Startz\OAuth2\Client\Provider\Etsy([
        'clientId'     => ETSY_KEY_STRING,
        'clientSecret' => ETSY_SHARED_SECRET,
        'redirectUri'  => ETSY_REDIRECT_URI,
    ]);

    if ( ! isset($_GET['code'])) 
    {
        // If we don't have an authorization code then get one
        $preChallenge = $provider->getPreChallenge();
        $authUrl = $provider->getAuthorizationUrl([
            'code_challenge' => $provider->getPKCE($preChallenge),
            'code_challenge_method' => 'S256'
        ]);
        $_SESSION['oauth2state'] = $provider->getState();
        $_SESSION['oauth2code'] = $preChallenge;
        header('Location: ' . $authUrl);
        exit;

    // Check given state against previously stored one to mitigate CSRF attack
    } elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {

        unset($_SESSION['oauth2state']);
        unset($_SESSION['oauth2code']);
        exit('Invalid state');

    } else {
        
        $preChallenge = $_SESSION['oauth2code'];
        $authParams = [
            'code' => $_GET['code'],
            'code_verifier' => $preChallenge,
        ];
        // Try to get an access token (using the authorization code grant)
        $token = $provider->getAccessToken('authorization_code', $authParams);

        // Optional: Now you have a token you can look up a users profile data
        try {

            // We got an access token, let's now get the user's details
            $user = $provider->getResourceOwner($token);
            printf('Hello %s!', $user->getName());

        } catch (Exception $e) {

            // Failed to get user details
            exit('Error...');
        }

        // Use this to interact with an API on the users behalf
        return $token->getToken();

        //return $output;
    }

The only point that I think might be related is that I'm using my laptop's hosts file to fake the domain of my website to be able to work with the API as it does not work with the localhost domain or HTTP.

Please advise.
Bests

[mohsenr1]

Any updates?

[slider1234]

it does work with Localhost for everyone else.

i posted this thread a while back to simplify the horrid tutorial. Try it out at discussion #1208
Most likely It could be that the redirect URI doesn't match the Callback URL. I made this same mistake at one point. The Etsy Developer tutorial just made it much more complicated than it needed to be.

[slider1234]

check this out and see if it helps at all.

// Ensure session is started for storing temporary OAuth states and codes
if (session_status() == PHP_SESSION_NONE) {
    session_start();
}

// Define plugin constants with your actual values
define('ETSY_KEY_STRING', 'XXXXXXXXXXXXXXXXXXXXXX');
define('ETSY_SHARED_SECRET', 'XXXXXXXXX');
define('ETSY_REDIRECT_URI', 'https://mydomain.com/etsy-products/');

require 'vendor/autoload.php';

// Configuration for OAuth provider
$config = [
    'clientId'                => ETSY_KEY_STRING,
    'clientSecret'            => ETSY_SHARED_SECRET,
    'redirectUri'             => ETSY_REDIRECT_URI,
    'urlAuthorize'            => 'https://www.etsy.com/oauth/connect',
    'urlAccessToken'          => 'https://api.etsy.com/v3/public/oauth/token',
    'urlResourceOwnerDetails' => '' // Not used in this context but required by the interface
];

// Create the OAuth provider object with the configuration
$provider = new \League\OAuth2\Client\Provider\GenericProvider($config);

// Authorization flow
if (!isset($_GET['code'])) {
    // If we don't have an authorization code, get one
    $options = [
        'scope' => ['transactions_r', 'listings_r'] // Adjust scope based on your needs
    ];
    $authUrl = $provider->getAuthorizationUrl($options);
    $_SESSION['oauth2state'] = $provider->getState();
    header('Location: ' . $authUrl);
    exit;
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
    // State validation failed
    unset($_SESSION['oauth2state']);
    exit('Invalid state');
} else {
    try {
        // Try to get an access token using the authorization code grant
        $accessToken = $provider->getAccessToken('authorization_code', [
            'code' => $_GET['code']
        ]);

        // Optional: Now you have a token you can look up a user's profile data
        // Etsy does not provide a standard way to get user details via OAuth2, so you might need to use Etsy API endpoints
        // For demonstration purposes
        printf('Access Token: %s', $accessToken->getToken());
    } catch (\League\OAuth2\Client\Provider\Exception\IdentityProviderException $e) {
        // Failed to get the access token
        exit($e->getMessage());
    }
}

[showtroylove]

It sounds like you have not registered your callback on Etsy website. The following link should take you there after you edit

https://www.etsy.com/developers - Click Manage your apps

• Add callback URL