# I am getting a CORS error everytime i try to exchange the code from the auth url for the access token , how to fix it ? I am working on a NEXT-JS project

**URL:** <https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174>\
**Category:** API & Developers\
**Created:** [29 September 2023 19:17 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174 "2023-09-29T19:17:34Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manav\_Jaral](https://luna1.co/8d76cd.png) [@Manav\_Jaral](https://forum.asana.com/u/Manav_Jaral)\
**Post date:** [29 September 2023 19:17 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/1 "2023-09-29T19:17:34Z")

</div>

![Screenshot (405)](https://us1.discourse-cdn.com/asana/original/3X/6/6/66a8c5b576e628fdae684f5ffbaf9c3f0754f223.png)

---

<div class="post-metadata">

**Author:** ![EntreEden](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/entreeden/32/199390_2.png) [@EntreEden](https://forum.asana.com/u/EntreEden)\
**Post date:** [29 September 2023 19:21 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/2 "2023-09-29T19:21:11Z")

</div>

What’s the error you’re getting back from Asana? Or is it “Token exchange failed”

---

<div class="post-metadata">

**Author:** ![Manav\_Jaral](https://luna1.co/8d76cd.png) [@Manav\_Jaral](https://forum.asana.com/u/Manav_Jaral)\
**Post date:** [29 September 2023 20:17 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/3 "2023-09-29T20:17:26Z")

</div>

From asana i am getting back this CORS issue , the error token exchange failed is something I have written for catching the error

```auto
const axios = require("axios").default;
const qs = require("qs"); 
const headers = {
   Accept: 'application/json',
  'Content-Type': 'application/x-www-form-urlencoded'
};

const tokenExchange = async (code: string) => {

  const clientId = "XXXXXXXX";
  const clientSecret = "XXXXXXXXX";
  const redirectUri = "http://localhost:3000/applogin/asana";
  const grantType = "authorization_code";

  const requestBody = {
    grant_type: grantType,
    client_id: clientId,
    client_secret: clientSecret,
    redirect_uri: redirectUri,
    code: code,

  };
 
  const url = 'https://app.asana.com/-/oauth_token';
  try {
    const response = await fetch(url, {
      method: 'POST',
      headers: headers,
      body : qs.stringify(requestBody)
    });
    const responseData = await response.json();
    console.log('Access token:', responseData.access_token);
    return responseData.access_token;
  } catch (error) {
    console.error({ error });
    throw new Error('Token exchange failed');
  }
};
export default tokenExchange;

```

I am able to generate the correct payload but fail to exchange the code for the access token , not sure what I am doing wrong

---

<div class="post-metadata">

**Author:** ![EntreEden](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/entreeden/32/199390_2.png) [@EntreEden](https://forum.asana.com/u/EntreEden)\
**Post date:** [29 September 2023 20:26 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/4 "2023-09-29T20:26:32Z")

</div>

What happens if you call this directly on your browser? So:

[https://app.asana.com/-/oauth\_token?grant\_type=authorization\_code&client\_id](https://app.asana.com/-/oauth_token?grant_type=authorization_code&client_id)…

Does that work?

---

<div class="post-metadata">

**Author:** ![Manav\_Jaral](https://luna1.co/8d76cd.png) [@Manav\_Jaral](https://forum.asana.com/u/Manav_Jaral)\
**Post date:** [29 September 2023 20:32 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/5 "2023-09-29T20:32:28Z")

</div>

Getting No route found error

---

<div class="post-metadata">

**Author:** ![EntreEden](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/entreeden/32/199390_2.png) [@EntreEden](https://forum.asana.com/u/EntreEden)\
**Post date:** [29 September 2023 20:37 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/6 "2023-09-29T20:37:47Z")

</div>

did you replace with your actual params?

---

<div class="post-metadata">

**Author:** ![Manav\_Jaral](https://luna1.co/8d76cd.png) [@Manav\_Jaral](https://forum.asana.com/u/Manav_Jaral)\
**Post date:** [29 September 2023 20:41 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/7 "2023-09-29T20:41:31Z")

</div>

yes yes obviously

---

<div class="post-metadata">

**Author:** ![EntreEden](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/entreeden/32/199390_2.png) [@EntreEden](https://forum.asana.com/u/EntreEden)\
**Post date:** [29 September 2023 20:56 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/8 "2023-09-29T20:56:09Z")

</div>

Hmm, that’s odd sorry can’t help much from here because even using the example URL you get some sort of error, I feel like the params you’re passing in are not being formatted correctly – I’d try printing out your requestBody to see if it’s what you expect

example URL: [Log in - Asana](https://app.asana.com/-/oauth_authorize?client_id=753482910&redirect_uri=http://localhost:3000/applogin/asana&response_type=code&state=thisIsARandomString&code_challenge_method=S256&code_challenge=671608a33392cee13585063953a86d396dffd15222d83ef958f43a2804ac7fb2&scope=default)

---

<div class="post-metadata">

**Author:** ![Frederic\_Malenfant](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/frederic_malenfant/32/8358_2.png) [@Frederic\_Malenfant](https://forum.asana.com/u/Frederic_Malenfant)\
**Post date:** [30 September 2023 22:08 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/9 "2023-09-30T22:08:58Z")

</div>

You can’t call that url from client-side in browser.

That’s because you must provide your secret key, that should be kept, secret 🙂 !  
So, your browser need to call your server that will do the oauth\_token call for you.  
It’s the same to get a new token from the refresh\_token.  
API tokens expires in less than 60 minutes.

Asana did not provide the required headers to allow cross-origin client-side calls, and that’s ok that they didn’t for that reason.

---

<div class="post-metadata">

**Author:** ![Manav\_Jaral](https://luna1.co/8d76cd.png) [@Manav\_Jaral](https://forum.asana.com/u/Manav_Jaral)\
**Post date:** [1 October 2023 06:57 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/10 "2023-10-01T06:57:44Z")

</div>

Okay , but the code i provided is a server side code , i am extracting the code from redirect authorization url and then passing that code to make this server side call for exchange of access token basically doing a POST request , it worked on Postman but on browser got this CORS error

---

<div class="post-metadata">

**Author:** ![Frederic\_Malenfant](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/frederic_malenfant/32/8358_2.png) [@Frederic\_Malenfant](https://forum.asana.com/u/Frederic_Malenfant)\
**Post date:** [3 October 2023 18:18 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/11 "2023-10-03T18:18:56Z")

</div>

> [@Manav\_Jaral](#):
>
> but on browser

So it’s not server side

---

<div class="post-metadata">

**Author:** ![system](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/system/32/276370_2.png) [@system](https://forum.asana.com/u/system)\
**Post date:** [30 May 2025 19:01 UTC](https://forum.asana.com/t/i-am-getting-a-cors-error-everytime-i-try-to-exchange-the-code-from-the-auth-url-for-the-access-token-how-to-fix-it-i-am-working-on-a-next-js-project/554174/12 "2025-05-30T19:01:31Z")

</div>