ArcGIS Server 'Invalid Token' from application, using REST API

[JackSilburn]

Hello.

I am struggling with an issue relating to ArcGIS Server REST API. I believe we are running v 10.6.

My process is:

1. Create an 'application' in the ArcGIS Server content.

1. Copy the 'client_id' and 'client_secret' values from this application.
2. Call the ArcGIS REST API oauth2/token endpoint
3. Copy the 'access_token' into the ArcGIS REST API /query endpoint
4. I am receiving a 'invalid token' error code 498.

I have completed this exact process in my organisation's ArcGIS Online platform, with no issues. So I am very perplexed and frustrated that this isn't working .

My token request:

POST /arcgis/sharing/rest/oauth2/token?client_id=XXX&client_secret=XXX&grant_type=client_credentials HTTP/1.1
Host: <domain>:<port>

My query request:

GET /arcgis/rest/services/Hosted/<feature layer name>/FeatureServer/0/query?where=1=1&token=XXX&f=json&outFields=name,device_type

HTTP/1.1
Host:<domain>:<port>

If I copy a token from my Chrome browser (f12 debug mode/network tab) I am able to make both requests successfully!!

I am 'admin' on our server and I own both the application and the feature layer.

Any help is appreciated.

Cheers

**update I tried running the /registerApp endpoint (using a browser Token)

I get the following:

"error": {
"code": 500,
"message": "Unable to register app.",
"details": [
"'redirect_uris' invalid"

I don't know what the purpose of the redirect_uris attribute is; I have tried <domain>:<port> and urn:ietf:wg:oauth:2.0:oob to no effect.

[MattScachette]

I was able to solve this but I was forced to use a different OAuth flow than the client_credentials flow. I too was hoping to pass in a client_id and client_secret and query the FeatureServer programmatically. 

Instead, to acquire a token which permitted a query of the feature layer, I had to use the user flow (not happy about this but have tried everything else)

curl --location 'https://www.arcgis.com/sharing/rest/generateToken' \

--header 'Content-Type: application/x-www-form-urlencoded' \

--form 'username="your_personal_username"' \

--form 'password="your_personal_password"' \

--form 'client="referer"' \

--form 'expiration="60"' \

--form 'f="json"' \

--form 'referer="https://localhost"'

With this cURL request, you can translate this into your language or tool of choice. 

Wish they would just fix this.