[GH-ISSUE #5657] [bug]: OAUTH_TOKEN_INVALID_RESPONSE when generate Oauth2.0 token with browser extension #2193

New issue

Open

opened 2026-03-16 23:32:12 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 23:32:12 +03:00

Owner

Originally created by @Leon-Luu on GitHub (Dec 4, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5657

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Web App

Browser

Chrome

Operating System

Windows

Bug Description

When attempt to "Generate Token" with OAuth2.0 Client Credential in the Collection properties using the "Browser extension" interceptor we will see OAUTH_TOKEN_INVALID_RESPONSE / "Failed to fetch token" as response. This is NOT happening if we switch to other interceptor like proxy/Agents where successful token is returned.

Please check and fix why this is happening only with the browser extension interceptor.

Step to step:

Choose browser extension as interceptor in settings
Got to Collection properties
Choose Authorization
Authorization type => OAuth2.0
Give the credentials inputs like ClientID/ClientSecret/Authorization Endpoints/Audience/Scopes
Press the "Generate token" button and check the result

Deployment Type

Hoppscotch Cloud

Version

2025.11.0

Originally created by @Leon-Luu on GitHub (Dec 4, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5657 ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Web App ### Browser Chrome ### Operating System Windows ### Bug Description When attempt to "Generate Token" with OAuth2.0 Client Credential in the Collection properties using the "Browser extension" interceptor we will see OAUTH_TOKEN_INVALID_RESPONSE / "Failed to fetch token" as response. This is NOT happening if we switch to other interceptor like proxy/Agents where successful token is returned. Please check and fix why this is happening only with the browser extension interceptor. <img width="1164" height="930" alt="Image" src="https://github.com/user-attachments/assets/af0235e3-a6ff-4988-9a96-a5dccb6ae0da" /> **Step to step:** 1) Choose browser extension as interceptor in settings 2) Got to Collection properties 3) Choose Authorization 4) Authorization type => OAuth2.0 5) Give the credentials inputs like ClientID/ClientSecret/Authorization Endpoints/Audience/Scopes 6) Press the "Generate token" button and check the result ### Deployment Type Hoppscotch Cloud ### Version 2025.11.0

kerem added the

bug

need testing

labels

2026-03-16 23:32:12 +03:00

kerem commented

2026-03-16 23:32:23 +03:00

Author

Owner

@Leon-Luu commented on GitHub (Feb 18, 2026):

What's actually happening:

The extension's service worker uses fetch() (in src/index.ts). The request construction is correct — URL-encoded body, proper headers, proper method. The response processing (base64 round-trip) is also correct. But Chrome's service worker fetch() adds browser-level headers (like Origin) that the proxy/agent paths don't add, because those make server-side requests without browser baggage.

When the OAuth server gets the extension's request, it returns an error response (e.g., HTTP 400 [{"error":"invalid_client"}].

The fix would need to happen in the browser extension itself (e.g., stripping browser-added headers) or by routing OAuth token requests through the proxy even when the extension is the active interceptor.

@Leon-Luu commented on GitHub (Feb 18, 2026): What's actually happening: The extension's service worker uses fetch() (in [src/index.ts](https://github.com/hoppscotch/hoppscotch-extension/blob/main/src/index.ts#L27-L56)). The request construction is correct — URL-encoded body, proper headers, proper method. The response processing (base64 round-trip) is also correct. But Chrome's service worker fetch() adds browser-level headers (like Origin) that the proxy/agent paths don't add, because those make server-side requests without browser baggage. When the OAuth server gets the extension's request, it returns an error response (e.g., HTTP 400 [{"error":"invalid_client"}]. The fix would need to happen in the browser extension itself (e.g., stripping browser-added headers) or by routing OAuth token requests through the proxy even when the extension is the active interceptor.