title: invalid_grant error when obtaining access token
body: <p>I am trying to build a website where a user can log in via Azure AD B2C. After logging in, I'm trying to present a secure area where the user can change their Azure B2C user attributes (first name, last name, etc) via the Microsoft Graph API.</p>
  
  <p>I am attempting to follow along with the <a href="https://docs.microsoft.com/en-gb/graph/auth-v2-user#3-get-a-token" rel="noreferrer">Get a Token documentation</a></p>
  
  <p>Everything is working up to step #3, where a call gets made out to <code>https://login.microsoftonline.com/common/oauth2/v2.0/token</code> to obtain an <code>access_token</code> using the code I received on my return URL.</p>
  
  <p>Here's the general flow of what I am doing:</p>
  
  <ol>
  <li>End user clicks a login link on my localhost site that links out to my Azure B2C tenant policy. Link looks something like this: </li>
  </ol>
  
  <pre><code>https://login.microsoftonline.com/mytenantname.onmicrosoft.com/oauth2/v2.0/authorize
  ?client_id=[MyAppID]
  &amp;response_type=code+id_token
  &amp;redirect_uri=http%3A%2F%2Flocalhost%3A17000%2Fprocessing%2Findex
  &amp;response_mode=query
  &amp;scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fuser.read%20https%3A%2F%2Fgraph.microsoft.com%2Fuser.write
  &amp;state=[MyCustomState]&amp;p=[MyCustomPolicy]
  </code></pre>
  
  <ol start="2">
  <li><p>User logs in and gets redirected to the <code>redirect_uri</code>.</p></li>
  <li><p><code>redirect_uri</code> successfully recieves <code>code</code>, <code>id_token</code>, and <code>state</code> values.</p></li>
  <li><p>I take the <code>code</code> value from that and makes a <code>POST https://login.microsoftonline.com/common/oauth2/v2.0/token</code> request with the following body:</p></li>
  </ol>
  
  <pre><code>POST https://login.microsoftonline.com/common/oauth2/v2.0/token
  HTTP/1.1
  
  grant_type=authorization_code
  &amp;code=[code]
  &amp;client_secret=[application secret]
  &amp;scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fuser.read%20https%3A%2F%2Fgraph.microsoft.com%2Fuser.readwrite
  &amp;redirect_uri=http%3A%2F%2Flocalhost%3A17000%2Fprocessing%2Findex
  </code></pre>
  
  <ol start="6">
  <li>The response code I receive back from that endpoint is the above error message.</li>
  </ol>
  
  <pre><code>{
    "error": "invalid_grant",
    "error_description": "AADSTS9002313: Invalid request. Request is malformed or invalid.\r\nTrace ID:6d7a8e32-bcbf-4fc4-a37a-87dae4781b00\r\nCorrelation ID:252912b7-5775-491a-968f-00ab03696dd9\r\nTimestamp: 2019-06-2722:11:18Z",
    "error_codes": [9002313],
    "timestamp": "2019-06-27 22:11:18Z",
    "trace_id": "6d7a8e32-bcbf-4fc4-a37a-87dae4781b00",
    "correlation_id": "252912b7-5775-491a-968f-00ab03696dd9"
  }
  </code></pre>
  
  <p>Other StackOverflow posts mention verifying that the redirect_uri's have to match between the initial login and the subsequent access_token requests. They appear identical to me, but I am still receiving errors.</p>
  
  <p>Any ideas what could be going wrong? </p>