I'm POSTing
- https://api.itch.io/oauth/token
?client_id=...
&grant_type=authorization_code
&code=...
&redirect_uri=https...
&code_verifier=...
and an empty post body, and getting {"errors":["invalid_grant"]} as a response. Am I missing something?
Viewing post in Document OAuth2 response_type=code
Does this also happen with a fresh authorization code exchanged immediately, on its first attempt? Could you check that code_verifier is the original unhashed value used to generate the S256 challenge, and that redirect_uri exactly matches the authorization request? Please don't post the code, verifier, or any tokens here.