title: Google API token endpoint POST returns Bad Request 400
body: <p>I am trying to exchange a one-time Google Plus Authorization code for an access token.  But I keep on getting a 400 Bad Request.  I am using VB.NET.  Here is the code:</p>
  
  <pre><code>        'We should now have a "good" one-time authorization code stored in "code"
      Using Client As New WebClient()
          'Dim Client As New WebClient()
          Dim values As New NameValueCollection()
          Dim Resp
          Dim responseString As String
  
          values("code") = Request.QueryString("code")
          values("client_id") = ConfigurationManager.AppSettings("google.clientid")
          values("client_secret") = ConfigurationManager.AppSettings("google.clientsecret")
          values("grant_type") = "authorization_code"
          values("redirect_uri") = "http://localhost:3333/MyVacations/default.aspx"
          Resp = Client.UploadValues("https://www.googleapis.com/oauth2/v3/token", values)
          responseString = Encoding.Default.GetString(Resp)
      End Using
  </code></pre>
  
  <p>I'm pretty sure this is the endpoint I'm supposed to be using <a href="https://www.googleapis.com/oauth2/v3/token" rel="nofollow noreferrer">https://www.googleapis.com/oauth2/v3/token</a> but who knows?  The <a href="https://developers.google.com/accounts/docs/OpenIDConnect#discovery" rel="nofollow noreferrer">Google Discovery Document</a> just muddles this for me.</p>
  
  <p>Also pardon my naivete but would someone explain how the POST code Google uses as an example relates to the Web Request in my code above?  I think I understand how the values translate, but the 3 header lines in the POST (below) ... how does this get specified in the VB code?  I'm missing something that must be really obvious to others so if you know, please tell me.</p>
  
  <pre><code>POST /oauth2/v3/token HTTP/1.1
  Host: www.googleapis.com
  Content-Type: application/x-www-form-urlencoded
  
  code=4/P7q7W91a-oMsCeLvIaQm6bTrgtp7&amp;
  client_id=8819981768.apps.googleusercontent.com&amp;
  client_secret={client_secret}&amp;
  redirect_uri=https://oauth2-login-demo.appspot.com/code&amp;
  grant_type=authorization_code
  </code></pre>
  
  <p>Another <a href="https://stackoverflow.com/questions/19625621/googles-oauth-endpoint-is-returning-a-bad-request-but-why">Stack Overflow Post</a> says something about sending the data as query parameters (using '&amp;' I guess) instead of sending the data as request headers, so is there something wrong with sending along a NameValueCollection?</p>