question

I am attempting to follow the Legacy token migration flow ( https://docs.clover.com/docs/legacy-token-migration-flow ) but I am leaving out the PKCE portion. I am unable to complete the migration successfully and now unable to get a new authorization_code after it appears the legacy access token has been invalidated.

For step 2, I used curl to POST to oauth/token/migrate_v2 as follows:

curl --request POST \\
    --url '<https://apisandbox.dev.clover.com/oauth/token/migrate_v2>' \\
    --header 'accept: application/json' \\
    --header 'authorization: Bearer [legacy_access_token]' \\
    --header 'content-type: application/json' \\
    --data '{"merchant_uuid": "[merchant_id]","app_uuid": "[app_id]","auth_token": "[legacy_access_token]"}'

After successfully receiving the authorization_code on the first attempt, I proceeded to step 4. I used curl to POST to /oauth/v2/token as follows:

curl --request POST \\
            --url '<https://apisandbox.dev.clover.com/oauth/v2/token>' \\
            --header 'accept: application/json' \\
            --header 'authorization: Bearer [legacy_access_token]' \\
            --header 'content-type: application/json' \\
            --data '{"client_id": "[app_id]","client_secret": "[app_secret]","code": "[authorization_code]"}'

However, my response was:

{"status":"Unauthorized","message":"Failed to validate authentication code."}

When I tried to repeat the curl POST to oauth/token/migrate_v2, each subsequent attempt would give me:

{"message":"Token is not valid or not available."}

So now I can no longer get an authorization code.

In the Legacy Token Migration flow docs ( https://docs.clover.com/docs/legacy-token-migration-flow ) it’s unclear what I need to use for the authorization: Bearer header particularly for the /oauth/v2/token request. Based on the flow chart it appears my legacy token was invalidated after making the oauth/token/migrate_v2 request and getting the authorization code.

Questions:

1. How can I trigger the oauth/token/migrate_v2 request again after it appears I no longer have a valid legacy access token?

2. Are changes needed to make both of my curl requests correct? And what should the authorization: Bearer portion look like for the /oauth/v2/token request?

Thanks for any help.