Code is expired with Keycloak provider

I’ve integrated angular-oauth2-oidc in my angular app v8 with Keycloak v4.5, my Keycloak configuration is based on “authorization_code” flow: grant_type: authorization_code

When I refresh my page the call to the token endpoint fails with 400 status:

/auth/realms/test/protocol/openid-connect/token

The response:

{"error":"invalid_grant","error_description":"Code is expired"}

My OIDC configuration is as follows:

export const authCodeFlowConfig: AuthConfig = {
  issuer: 'http://localhost:8080/auth/realms/test',
  redirectUri: window.location.origin + '/page/dashboard',
  postLogoutRedirectUri: window.location.origin + '/login',
  clientId: 'ClientTest',
  responseType: 'code',
  scope: 'openid profile email offline_access api',
  showDebugInformation: true,
  requireHttps: false,
  disableAtHashCheck: true
};

I initialised the oauth2 module as follows in app.module.ts:

export function initCodeFlow(oauthService: OAuthService) {
  return () => {
    oauthService.configure(environment.authCodeFlowConfig);
    oauthService.loadDiscoveryDocumentAndTryLogin();
  };
}
// ...
 {
      provide: APP_INITIALIZER,
      useFactory: initCodeFlow,
      multi: true,
      deps: [OAuthService],
    },

And my realm configuration is based on “Standard code flow + implicit flow”.

I don’ know if it can be an issue or a wrong configuration that I made

Any help will be very appreciated

[odaper]

Thanks a lot @jeroenheijmans, I will check and be back with more info soon

[jeroenheijmans]

Thx for sharing, good to hear you’ve solved things!

Got no additions, other perhaps than to say that my sample project’s master is now also Code+PKCE flow.

In any case, each app will have its own variant, so it’s great that you’ve shared your approach!