# LwA "invalid grant parameter : redirect\_uri"

**URL:** <https://community.amazondeveloper.com/t/lwa-invalid-grant-parameter-redirect-uri/24837>\
**Category:** Q&A\
**Tags:** appstore-lwa\
**Created:** [November 22, 2025, 12:09am UTC](https://community.amazondeveloper.com/t/lwa-invalid-grant-parameter-redirect-uri/24837 "2025-11-22T00:09:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tal.Kedar](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Tal.Kedar](https://community.amazondeveloper.com/u/Tal.Kedar)\
**Post date:** [November 22, 2025, 12:09am UTC](https://community.amazondeveloper.com/t/lwa-invalid-grant-parameter-redirect-uri/24837/1 "2025-11-22T00:09:57Z")

</div>

Using LwA on a website, trying to exchange the `code` for access and refresh tokens through a backend call to `https://api.amazon.com/auth/o2/token`, we’re getting an error (`400` status) response :  
`{`  
` "error_index": "...",`  
` "error_description": "The request has an invalid grant parameter : redirect_uri",`  
` "error": "invalid_grant",`  
` "request_id": "..."`  
`}`

The documentation says that the `redirect_uri` is mandatory in the request, presumably so that LwA could compare it with the one used when issuing the `code`. We’ve double checked that the value of the `redirect_uri` is correct and identical in the authorization and the exchange, url-encoded properly, the request content type is indeed `application/x-www-form-urlencoded` and contains just `grant_type=authorization_code` as well as the code, client id and secret and the `redirect_uri`, which is included in the security profile “allowed return URLs”.

What other reasons could there be for this error?

---

<div class="post-metadata">

**Author:** ![Emma](https://dhm3gbtzu79o6.cloudfront.net/user_avatar/community.amazondeveloper.com/emma/32/880_2.png) [@Emma](https://community.amazondeveloper.com/u/Emma)\
**Post date:** [November 24, 2025, 2:01am UTC](https://community.amazondeveloper.com/t/lwa-invalid-grant-parameter-redirect-uri/24837/3 "2025-11-24T02:01:44Z")

</div>

Hi @Tal.Kedar ,

Thanks for posting. We have messaged the appropriate team for further investigation and will let you know once we receive an update.

---

<div class="post-metadata">

**Author:** ![Tal.Kedar](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Tal.Kedar](https://community.amazondeveloper.com/u/Tal.Kedar)\
**Post date:** [November 27, 2025, 4:40pm UTC](https://community.amazondeveloper.com/t/lwa-invalid-grant-parameter-redirect-uri/24837/4 "2025-11-27T16:40:35Z")

</div>

The issue was due to a bug in a library we used for url-encoding on the server side: the logical `redirect_uri` values were correct and identical in both calls, but the url-encoded values were different.

---

<div class="post-metadata">

**Author:** ![system](https://dhm3gbtzu79o6.cloudfront.net/user_avatar/community.amazondeveloper.com/system/32/5065_2.png) [@system](https://community.amazondeveloper.com/u/system)\
**Post date:** [December 11, 2025, 4:41pm UTC](https://community.amazondeveloper.com/t/lwa-invalid-grant-parameter-redirect-uri/24837/5 "2025-12-11T16:41:35Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.