{"action":"closed","issue":{"url":"https://api.github.com/repos/requests/requests-oauthlib/issues/227","repository_url":"https://api.github.com/repos/requests/requests-oauthlib","labels_url":"https://api.github.com/repos/requests/requests-oauthlib/issues/227/labels{/name}","comments_url":"https://api.github.com/repos/requests/requests-oauthlib/issues/227/comments","events_url":"https://api.github.com/repos/requests/requests-oauthlib/issues/227/events","html_url":"https://github.com/requests/requests-oauthlib/issues/227","id":136201228,"number":227,"title":"InvalidClient: HTTPBasicAuth with username and password for Legacy Applications","user":{"login":"synasius","id":217898,"avatar_url":"https://avatars.githubusercontent.com/u/217898?v=3","gravatar_id":"","url":"https://api.github.com/users/synasius","html_url":"https://github.com/synasius","followers_url":"https://api.github.com/users/synasius/followers","following_url":"https://api.github.com/users/synasius/following{/other_user}","gists_url":"https://api.github.com/users/synasius/gists{/gist_id}","starred_url":"https://api.github.com/users/synasius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/synasius/subscriptions","organizations_url":"https://api.github.com/users/synasius/orgs","repos_url":"https://api.github.com/users/synasius/repos","events_url":"https://api.github.com/users/synasius/events{/privacy}","received_events_url":"https://api.github.com/users/synasius/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-24T22:08:48Z","updated_at":"2016-03-16T09:14:30Z","closed_at":"2016-03-16T09:14:30Z","body":"I stumbled upon this error while trying to use requests-oauthlib with an oauth2 server created using django-oauth-toolkit. I think that there is a misunderstanding of section 2.3.1 of the RFC 6749 (here is the link https://tools.ietf.org/html/rfc6749#section-2.3.1) that is also the cause of #221 and #218 \r\n\r\nThe RFC says:\r\n> Clients in possession of a client password MAY use the HTTP Basic\r\n   authentication scheme as defined in [RFC2617] to authenticate with\r\n   the authorization server.\r\n\r\nThe `client password` is the `client secret`. How should we create a Basic Auth Header? the RFC says:\r\n> The *client identifier* is encoded using the\r\n   \"application/x-www-form-urlencoded\" encoding algorithm per\r\n   Appendix B, and the encoded value is used as the username; the *client\r\n   password* is encoded using the same algorithm and used as the\r\n   password.\r\n\r\nclient_id is used as username.\r\nclient_secret is used as password.\r\n\r\nSo I think that the header should be create as follows (and that is what we expect in django-oauth-toolkit):\r\n```\r\nauth = requests.auth.HTTPBasicAuth(client_id, client_secret)\r\n```\r\nthe problem is that `username` and `password` are used instead, which are user's credentials and not the application's credentials.\r\n\r\nAlso, the RFC example shows the following header\r\n> Authorization: Basic czZCaGRSa3F0Mzo3RmpmcDBaQnIxS3REUmJuZlZkbUl3\r\n\r\nIf you decode the base64 value you'll get:\r\n```\r\n>>> base64.b64decode('czZCaGRSa3F0Mzo3RmpmcDBaQnIxS3REUmJuZlZkbUl3')\r\n>>> b's6BhdRkqt3:7Fjfp0ZBr1KtDRbnfVdmIw'\r\n```\r\nwhich are the client_id and client_secret  used in the example at the end of section 2.3.1\r\n\r\n\r\n\r\n\r\n"}}