title: Microsoft DeviceCode Authentication returning 'invalid-request' error
body: <p>Within the Electron app I'm creating, I'm trying to authenticate a personal Microsoft account and obtain the access token and refresh token using the DeviceCode method. (<a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code" rel="nofollow noreferrer">Using these instructions)</a> I am able to successfully retrieve the DeviceCode needed to login using the following:</p>
  <pre class="lang-js prettyprint-override"><code>var bod1 = new URLSearchParams();
      bod1.append('client_id', '6fbc920e-8515-414c-ac36-296b084e6fb2');
      bod1.append('scope', 'offline_access XboxLive.signin');
  
  var req1 = await fetch('https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode', {
      method: 'POST',
      headers: {
          'Content-Type': 'application/x-www-form-urlencoded'
      },
      body: bod1
  }).then(res =&gt; {return res.json()});
  </code></pre>
  <p>The above request returns something similar to:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;user_code&quot;: &quot;B6N9D34T&quot;,
      &quot;device_code&quot;: &quot;DEVICE ID&quot;,
      &quot;verification_uri&quot;: &quot;https://www.microsoft.com/link&quot;,
      &quot;expires_in&quot;: 900,
      &quot;interval&quot;: 5,
      &quot;message&quot;: &quot;To sign in, use a web browser to open the page https://www.microsoft.com/link and enter the code B6N9D34T to authenticate.&quot;
  }
  </code></pre>
  <p>I send the user to <code>verification_uri</code> (<code>https://www.microsoft.com/link</code>) and they input the <code>user_code</code> and they sign in as normal. Following <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code#authenticating-the-user" rel="nofollow noreferrer">Step 2</a> I run the following request every 5 seconds until the user finished logging in using the code and URL above:</p>
  <pre class="lang-js prettyprint-override"><code>var bod2 = new URLSearchParams();
      bod2.append('client_id', '6fbc920e-8515-414c-ac36-296b084e6fb2');
      bod2.append('grant_type', 'urn:ietf:params:oauth:grant-type:device_code');
      bod2.append('device_code', req1.device_code);
  
  while (done2 == false) {
      await fetch('https://login.microsoftonline.com/consumers/oauth2/v2.0/token', {
              method: 'POST',
              headers: {
                  'Content-Type': 'application/x-www-form-urlencoded'
              },
              body: bod2
          })
          .then(res =&gt; {
              return res.json()
          })
          .then(result =&gt; {
              if (!result.error) {
                  req2 = result;
                  done2 = true;
              }
          });
  };
  </code></pre>
  <p>which is <strong>supposed</strong> to return something similar to the following JSON (once the user completes the login using the code that I gave earlier):</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;token_type&quot;: &quot;Bearer&quot;,
      &quot;scope&quot;: &quot;offline_access XboxLive.signin&quot;,
      &quot;expires_in&quot;: 3599,
      &quot;access_token&quot;: &quot;TOKEN&quot;,
      &quot;refresh_token&quot;: &quot;OTHER TOKEN&quot;,
      &quot;id_token&quot;: &quot;OTHER OTHER TOKEN&quot;
  }
  </code></pre>
  <p>But instead it returns this:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;error&quot;:&quot;invalid_request&quot;,
      &quot;error_description&quot;:&quot;AADSTS90023: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type.\r\nTrace ID: 97afe241-4a2f-4336-9f41-ab8343120700\r\nCorrelation ID: 9c05a420-ae3a-4031-9b8a-b002d72c49b1\r\nTimestamp: 2021-10-03 01:39:18Z&quot;,
      &quot;error_codes&quot;:[90023],
      &quot;timestamp&quot;:&quot;2021-10-03 01:39:18Z&quot;,
      &quot;trace_id&quot;:&quot;97afe241-4a2f-4336-9f41-ab8343120700&quot;,
      &quot;correlation_id&quot;:&quot;9c05a420-ae3a-4031-9b8a-b002d72c49b1&quot;
  }
  </code></pre>
  <p>and I can't figure out why.
  I should note that I have tried doing this just using Node without Electron, and it works perfectly, but not when running in an Electron app.</p>