{"record":{"id":"7144e1f22bcb9f70","repo":"thephpleague/oauth2-server","slug":"invalid-request-the-is-missing-a-required-parameter-is","errorCode":"invalid_request","errorMessage":"The request is missing a required parameter, is invalid, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the \"code\" parameter","messagePattern":"The request is missing a required parameter, is invalid, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed\\. Check the \"code\" parameter","errorType":"http","errorClass":"OAuthServerException","httpStatus":400,"severity":"error","filePath":"src/Grant/AuthCodeGrant.php","lineNumber":105,"sourceCode":"        $this->requireCodeChallengeForPublicClients = false;\n    }\n\n    /**\n     * Respond to an access token request.\n     *\n     * @throws OAuthServerException\n     */\n    public function respondToAccessTokenRequest(\n        ServerRequestInterface $request,\n        ResponseTypeInterface $responseType,\n        DateInterval $accessTokenTTL\n    ): ResponseTypeInterface {\n        $client = $this->validateClient($request);\n\n        $encryptedAuthCode = $this->getRequestParameter('code', $request);\n\n        if ($encryptedAuthCode === null) {\n            throw OAuthServerException::invalidRequest('code');\n        }\n\n        try {\n            $authCodePayload = json_decode($this->decrypt($encryptedAuthCode));\n\n            $this->validateAuthorizationCode($authCodePayload, $client, $request);\n\n            $scopes = $this->scopeRepository->finalizeScopes(\n                $this->validateScopes($authCodePayload->scopes),\n                $this->getIdentifier(),\n                $client,\n                $authCodePayload->user_id,\n                $authCodePayload->auth_code_id\n            );\n        } catch (InvalidArgumentException $e) {\n            throw OAuthServerException::invalidGrant('Cannot validate the provided authorization code');\n        } catch (LogicException $e) {\n            throw OAuthServerException::invalidRequest('code', 'Issue decrypting the authorization code', $e);","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/Grant/AuthCodeGrant.php#L87-L123","documentation":"Thrown by the authorization code grant's respondToAccessTokenRequest when the token request has no 'code' parameter to exchange. The grant validates the client, then reads the required 'code' request parameter; its absence makes the token exchange request invalid under the OAuth2 spec.","triggerScenarios":"POSTing to /access_token with grant_type=authorization_code but omitting the code parameter, sending it under a different key (e.g. authorization_code or authCode), or the client losing the code between the redirect and the token call.","commonSituations":"Client-side redirect handlers store the code in state but never include it in the token request; frontend/backend mismatches where the frontend strips query params; single-page apps calling the token endpoint with only code_verifier and client_id; integration tests whose POST body lacks 'code'.","solutions":["Ensure the token request includes the code parameter received from the authorization redirect: POST code=<authorization_code> with grant_type=authorization_code","Verify your HTTP layer forwards the authorization response's ?code=... query value to the token request body","Check parameter naming — it must be exactly 'code', not 'auth_code' or 'authorization_code'","In tests, add 'code' to the request body before calling respondToAccessTokenRequest"],"exampleFix":"// before\nconst body = { grant_type: 'authorization_code', client_id, redirect_uri };\n// after\nconst body = { grant_type: 'authorization_code', client_id, redirect_uri, code: authCode };","handlingStrategy":"validation","validationCode":"if (!authCode || typeof authCode !== 'string') {\n  throw new Error('authorization code missing — cannot call token endpoint');\n}","typeGuard":"function hasAuthCode(q: Record<string, unknown>): q is Record<string, string> & { code: string } { return typeof q.code === 'string' && q.code.length > 0; }","tryCatchPattern":"try {\n  return await tokenClient.exchange({ grant_type: 'authorization_code', code, ... });\n} catch (e) {\n  if (e.code === 'invalid_request' && e.hint?.includes('code')) {\n    console.error('Token request missing code parameter');\n  }\n  throw e;\n}","preventionTips":["Always carry the ?code query value from the authorization redirect into the token request body","Use the exact parameter name 'code' in the token request","Validate the token request payload in the client before sending","Persist the code (session/storage) if the redirect and exchange happen in different requests"],"tags":["oauth2","authorization-code","missing-parameter","token-exchange"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}