Clio OAuth2 - "Invalid key=value pair (missing equal-sign) in Authorization header"

Questions
1

Problem

I’m trying to connect to Clio API using Generic OAuth2 in n8n. The credential connects successfully (shows “Account connected”), but when I make an API call, I get:

Forbidden - perhaps check your credentials?

Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): ‘d6JP8++notUKP7U6sFeyD2a5QuwNgKG2qLI0h4C3uUg=’.

What I’ve Tried

  • :white_check_mark: Correct Authorization URL: https://app.clio.com/oauth/authorize

  • :white_check_mark: Correct Access Token URL: https://app.clio.com/oauth/token

  • :white_check_mark: Redirect URI matches Clio Developer Portal: https://oauth.n8n.cloud/oauth2/callback

  • :white_check_mark: Scope: billing contacts matters

  • :white_check_mark: Auth URI Query Parameters: access_type=offline

  • :white_check_mark: Authentication: Body

  • :white_check_mark: Token manually exchanges successfully via curl

Any help is appreciated!

2

Hi @zeta_pashupati
That error comes from AWS API Gateway, not from Clio, so the request is being rejected before it ever reaches the Clio Manage API. Clio Manage and Clio Platform are separate products on separate hosts with separate OAuth servers, and a Manage token (app.clio.com/oauth) sent to the Platform host api.clio.com gets rejected exactly like this. Point the HTTP Request URL at the Manage base URL and test the credential with:

https://app.clio.com/api/v4/users/who_am_i

If that returns your user, the credential is fine and only the URL was wrong. The base URL also has to match the region of the Clio account, eu.app.clio.com/api/v4, ca.app.clio.com/api/v4 or au.app.clio.com/api/v4, since a token issued in one region is not valid against another.

3

Hi @zeta_pashupati

This happens because Clio has two separate environments with different OAuth servers and API hosts: Clio Manage and Clio Platform​.

  • Clio Manage: Uses app.clio.com/oauth for authentication and expects requests to be sent to app.clio.com/api/v4.
  • Clio Platform: Uses a different OAuth flow and expects requests at api.clio.com.

Because you used app.clio.com/oauth to get your token, you have a Clio Manage token​. If you then try to send that token to api.clio.com, the AWS API Gateway guarding the Platform API doesn’t recognize the token format and tries to parse the Authorization header as a different type of AWS signature. When it fails to find the expected key=value pairs in that signature, it throws the error: “Invalid key=value pair (missing equal-sign)”.

If you are trying to access Clio Manage data:

  • Incorrect URL: https://api.clio.com/v4/...
  • Correct URL: https://app.clio.com/api/v4/...

Switch your request URL from api.clio.com to app.clio.com and your request should go through successfully.

4

A common issue with signature parsing from AWS API Gateway usually occurs when a managed token is sent to the endpoint api.clio.com. It is also advisable to check the region. The endpoint app.clio.com is for US-based customers only. If your account is based in the EU, CA, or AU, please use eu.app.clio.com, ca.app.clio.com, or au.app.clio.com for both the OAuth URLs and the API base URL, otherwise, you will encounter an authentication mismatch even after changing the host.

5

@Anshul_Namdev Thank you so much for the clarification. In any way can we connect and discuss on what we are working on? I would love to connect with you.

6

@ShawnWilliams Thank you so much for the suggestion and clarity. Can I connect with you in any way, so that we can discuss more about what we do, and how we are planning to moving forward?

7

@kjooleng Thak you so much for the clarity. Can we connect in any platform of your choice and discuss on future and goal? Would love to connect.