Hi Descope , am having issue with the golang sdk , when calling Management.OutboundApplication().FetchUserToken(...) its returning "Outbound app token not found" when doing the call using rest api v1/mgmt/outbound/app/user/token/latest , sending the exact appId and userId , its returning the data . am using the latest 1.8.0 sdk . can some one check its working ?

@Reuven Zabirov @Tal Aharoni can you help here ?

@kojan abzah Can you please share the project ID?

P2bIxsiEcyH9cUguTWj6iJLcZNza

Hi @kojan abzah, Please note that in the API you use

.../latest

while in the SDK you don't. The difference is that you need to provide the exact scopes of the token you are willing to fetch while when using the latest you are asking for the latest token without specifying the scopes. Currently the

latest

API is not supported in the GO sdk but we can add it if required.

same issue

token, err := p.descopeClient.Management.OutboundApplication().FetchUserToken(ctx, &descope.FetchOutboundAppUserTokenRequest{
       AppID:  "gmail",
       UserID: userID,
       Scopes: []string{
          "<https://www.googleapis.com/auth/gmail.readonly>",
          "<https://www.googleapis.com/auth/gmail.send>",
          "<https://www.googleapis.com/auth/gmail.labels>",
          "<https://www.googleapis.com/auth/gmail.compose>",
       },
    })

if you are using userID

U2eHGgjJVx9mArVfcsRBykF8OJoN

- there is no token with those scope for this user...

if you think the issue is in my scopes isnt it suppose to to return error reflecting that ?

The error is indeed reflecting that a token with the requested userID+appID+Scopes doesn't exist. We will consider adding a hint or specifying it more clearly in the error

Hi Tal, can you check my last 2 screen shots ? it clearly shows it hast that two scopes i am requesting , the one with the data is from the rest api

Yes you probably added space in the app scopes. It's recommended to use the sdk and know the scopes you are requesting. In some cases, where you can't know the scopes, or have only one constant set of scopes you can use the

lastest

. To make sure, you are requesting we the exact scopes via the sdk and still not getting the token? Can you do the request (with the needed space in that case) and share with me the exact time? i'll take a look

good news , yes it worked with the space . am still having hards time understanding this , i dont want my backend to be coupled with what scopes the frontend needs , why do i need to send the exact scopes the user approved in my frontend ? the backend service i am working on is decoupled from the frontend and he needs only "https://www.googleapis.com/auth/gmail.send" scope . also do you know where did that space came from ? i dont see spaces in the Descope UI when i look at the scopes i configured for gmail

I understand. We ask to specify the requested scope because asking for scopes a,b and getting token with scopes a,b,c can cause security issues as you may give an agent or 3rd party app more permissions than expected. If the token is used only in your backend and you don't care if this token contains additional permissions you can use the

latest

option. Regarding that extra space, the scopes be received from several places: 1. the outbound app default scopes 2. the connect action in the flow (if using flows) 3. parameter on the connect request (if using API/SDK) Probably in one of them the space exist.

got it , thanks , moving to api calls to use the latest option and check if it has the scope i need .