Tried access-token-request did not receive any whatsapp notification

General
1

Access Token Request for User | Upstox Developer API

I thought the above access token request will make it easier for me to generate access token as cloudfare blocks selenium logins, so whatsapp notification for approval is acceptable alternative where server will send the request and we have to just approve via whatsapp.

tried below
curl -L -X POST ‘https://api.upstox.com/v3/login/auth/token/request/clientId’
-H ‘Accept: application/json’ -d ‘{ “client_secret”: “***********”}’

got the below response:-

{“status”:“error”,“errors”:[{“errorCode”:“UDAPI10000”,“message”:“This request is not supported by Upstox API”,“propertyPath”:null,“invalidValue”:null,“error_code”:“UDAPI10000”,“property_path”:null,“invalid_value”:null}]}

Could you please help how to make the above flow working, how to get whatsapp notification to approve the request and streamline the login process.

2

Hi @athma_prathisti,

We are checking this and will get back to you soon. Thanks.

3

Please use the following cURL request. You can also refer to the same code here: Access Token Request Documentation.

curl -X 'POST' 'https://api.upstox.com/v3/login/auth/token/request/********' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-d '{
  "client_secret": "{your_client_secret}"
}'
4

Thanks it makes sense to add content-Type missed it, how to locally provide the notification url, should i use ngrok or you have some better recommendation, basically what I want is to trigger the request locally and approved via whatsapp and get access token locally before deploying to the server.

as it fails with invalid
“message”:“Invalid notifier url”

5

@athma_prathisti I’m glad to hear it’s working for you!

You can certainly use tools like ngrok, but it must comply with our organization’s firewall rules. Otherwise, it may be blocked for security reasons, and you won’t receive any updates.

If your goal is just to inspect the received webhook payload, you can use online tools like Webhook.site.

Thanks

6

Thanks for this i tested with webhook.site it works.
But for server I have purchased a domain, now my only concern is how to secure it, because people can figure out that a particular endpoint is available for any POST. do you have specific ips that i can whitelist, although I will make the url totally random and unpredictable but you never know as it is on internet and i am not an expert of security practices related related to reverse proxy. although i will only allow POST to that endpoint and disable rest of the endpoint except index.html.
any suggestions, because I believe due to this webhook security of entire VPS might be at risk as I am accepting incoming connections due to this webhook setup.

7

@athma_prathisti Could you please share the domain where your notifier will be hosted? We can whitelist it on our end to unblock you.

We are working with our IT team to implement a solution ensuring a seamless user experience. We will update this thread once it’s done.

8

Hi @Pradeep_Jaiswar
Below is the domain name, please whitelist it. Even though it is secure but its not getting the access token
https://2398467.xyz

Thanks for your efforts

9

Need help I am stuck with this as I am not receiving the access token, the endpoint works for my site and it is having certs. So not sure why not receiving any access token requests from your end, my reverse proxy logs does not show any activity from your end after I approve the access token request through Whatsapp.

10

@athma_prathisti It looks like this is a newly registered domain that our firewalls have flagged as suspicious.

Is there a specific reason for the random number in the domain name? If possible, I suggest using a more structured alphanumeric domain and give it for whitelisting.

11

Numeric domains are cheaper to get, why would I purchase a costlier domain for this. Please whitelist this domain as I purchased it for very long term.
I had no intention of purchasing any domains but I think most of the vendors will follow your approach, Hence thought of purchasing one domain for all.

12

@Pradeep_Jaiswar
I have verified if it is detected suspicious anywhere else, here is the report.
2398467.xyz Safe? Check it Now | URLVoid

I am stuck with this for few days, please whitelist it hopefully with time it will be detected normally in your system.

13

Hi @athma_prathisti,

Please give us some time to check this. We will get back to you soon with an update, thanks.

14

ok Thanks Pradeep confirmed that it is blocked due to firewall at your end, if my domain is whitelisted this issue will be resolved.

15

It doesn’t take much time to whitelist, I do not understand whats the hold up for this long.

16

why you guys are wasting my time on this I am missing opportunities, it doesn’t take much to whitelist, could you please do the needful and update.

17

Hi @athma_prathisti,

This is being looked at and we will update you regarding the status ASAP. We appreciate your patience in the meanwhile. Thanks.

18

@Ushnota
Thank you for the update.

19

@Ushnota

whitelisting a domain in cloudflare is just 5 mins job, and it is more than 5 hours and no reply, I am really frustrated with this.

20

Please be advised that, according to protocol, we do not make system changes during market hours to prevent any errors (this change is not at Cloudflare but in the firewall). Rest assured, your request will be processed by the end of the day (EOD).