# 403 Forbidden for Auth Toke using Spring **URL:** \ **Category:** API Support\ **Created:** [August 6, 2019, 7:50am UTC](https://discuss.dwolla.com/t/403-forbidden-for-auth-toke-using-spring/5296 "2019-08-06T07:50:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mahendra\_Goyal](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/mahendra_goyal/32/2189_2.png) [@Mahendra\_Goyal](https://discuss.dwolla.com/u/Mahendra_Goyal)\ **Post date:** [August 6, 2019, 7:50am UTC](https://discuss.dwolla.com/t/403-forbidden-for-auth-toke-using-spring/5296/1 "2019-08-06T07:50:39Z")
I am using following code: public String getDwollaAuthToken() //throws JsonMappingException,JsonParseException,IOException { DwollaAuthTokenResponse dwollaResponse = null; try { HttpHeaders headers = new HttpHeaders(); headers.setContentType(MediaType.APPLICATION\_FORM\_URLENCODED); UriComponentsBuilder uriBuilder = UriComponentsBuilder.fromHttpUrl(env.getProperty(“dwolla.api.url”)+"/"+RBLMConstants.DWOLLA\_AUTH\_API); ``` MultiValueMap body = new LinkedMultiValueMap<>(); body.add("grant_type", "client_credentials"); body.add("client_secret", env.getProperty("dwolla.api.secret")); body.add("client_id", env.getProperty("dwolla.api.key")); HttpEntity> requestEntity = new HttpEntity<>(body, headers); ResponseEntity responseEntity = restTemplate.exchange(uriBuilder.toUriString(), HttpMethod.POST, requestEntity, String.class); dwollaResponse = objectMapper.readValue(responseEntity.getBody(), DwollaAuthTokenResponse.class); }catch(Exception e) { log.debug(e.getLocalizedMessage(),e); } return dwollaResponse.getAccess_token(); } ``` Getting org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:83) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:122) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:102) at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63) at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:778) at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:736) at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:670) at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:579) at com.rblm.api.service.DwollaAPIService.getDwollaAuthToken(DwollaAPIService.java:56) at com.rblm.api.service.DwollaAPIService$$FastClassBySpringCGLIB$$d49843bd.invoke() at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:749) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) at org.springframework.aop.framework.adapter.MethodBeforeAdviceInterceptor.invoke(MethodBeforeAdviceInterceptor.java:56) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.framework.adapter.AfterReturningAdviceInterceptor.invoke(AfterReturningAdviceInterceptor.java:55) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.framework.adapter.AfterReturningAdviceInterceptor.invoke(AfterReturningAdviceInterceptor.java:55) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.aspectj.AspectJAfterThrowingAdvice.invoke(AspectJAfterThrowingAdvice.java:62) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:93) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688) at com.rblm.api.service.DwollaAPIService$$EnhancerBySpringCGLIB$$3ecbe20a.getDwollaAuthToken() at com.rblm.api.controller.DwollaController.getDwollaAuthToken(DwollaController.java:28) at com.rblm.api.controller.DwollaController$$FastClassBySpringCGLIB$$45acbd0f.invoke() at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:749) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) at org.springframework.aop.framework.adapter.MethodBeforeAdviceInterceptor.invoke(MethodBeforeAdviceInterceptor.java:56) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.framework.adapter.AfterReturningAdviceInterceptor.invoke(AfterReturningAdviceInterceptor.java:55) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.framework.adapter.AfterReturningAdviceInterceptor.invoke(AfterReturningAdviceInterceptor.java:55) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.aspectj.AspectJAfterThrowingAdvice.invoke(AspectJAfterThrowingAdvice.java:62) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:93) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688) at com.rblm.api.controller.DwollaController$$EnhancerBySpringCGLIB$$a9eeb140.getDwollaAuthToken() at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189) at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:892) at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:797) at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005) at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:908) at javax.servlet.http.HttpServlet.service(HttpServlet.java:660) at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:117) at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:106) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Unknown Source) ---
**Author:** ![shreya](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/shreya/32/2154_2.png) [@shreya](https://discuss.dwolla.com/u/shreya)\ **Post date:** [August 6, 2019, 6:47pm UTC](https://discuss.dwolla.com/t/403-forbidden-for-auth-toke-using-spring/5296/2 "2019-08-06T18:47:24Z")
Hi @Mahendra_Goyal, From what we can see, there seems to be no glaring issues with your request to create an access token. Would you be able to share the endpoint you are using for generating an access token? Additionally, we do have a new [Java/Kotlin SDK](https://github.com/Dwolla/dwolla-v2-kotlin) that you could maybe utilize or refer to when creating access tokens. I do want to mention that the Dwolla V2 Kotlin SDK is currently provided as a preview to developers so that we can gather feedback prior to release. It doesn’t currently contain support for all Dwolla endpoints, but it does support creating access tokens along with token management for refreshing the token before it expires every hour. If you check it out, please let us know if you have any feedback on the SDK! ---
**Author:** ![alphathesis](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@alphathesis](https://discuss.dwolla.com/u/alphathesis)\ **Post date:** [August 15, 2019, 2:14pm UTC](https://discuss.dwolla.com/t/403-forbidden-for-auth-toke-using-spring/5296/3 "2019-08-15T14:14:21Z")
Hey @Mahendra_Goyal I believe you have to convert the key and secret into a Base64 encoded string and pass that in. Not sure if you resolved this but here’s how I have it working: ``` public static String getBasicAuthenticationHeader(String inUsername, String inPassword) { String auth = inUsername + ":" + inPassword; byte[] encodedAuth = org.apache.commons.codec.binary.Base64.encodeBase64( auth.getBytes(Charset.forName("US-ASCII"))); String theAuthenticationHeader = "Basic " + new String(encodedAuth); return theAuthenticationHeader; } public HttpEntity getHttpHeadersWithBasicAuthorization(String inUsername, String inPassword, Map inCustomHeaders) { HttpHeaders theHeaders = new HttpHeaders(); theHeaders.add("Accept", MediaType.APPLICATION_JSON_VALUE); theHeaders.add("Content-Type", MediaType.APPLICATION_JSON_VALUE); if (Objects.nonNull(inCustomHeaders) && inCustomHeaders.size() > 0) { for (String theKey : inCustomHeaders.keySet()) { theHeaders.add(theKey, inCustomHeaders.get(theKey)); } } HttpHeaders theHttpHeaders = new HttpHeaders(); theHttpHeaders.setContentType(MediaType.APPLICATION_FORM_URLENCODED); String theBasicAuthorizationKey = getBasicAuthenticationHeader( inUsername, inPassword); theHttpHeaders.add(HttpHeaders.AUTHORIZATION, theBasicAuthorizationKey); return new HttpEntity<>(theHeaders, theHttpHeaders); } ``` You can then pass that HttpEntity object into your restTemplate call accordingly.