I’m trying to set up a fresh Frame.io API integration using Adobe IMS OAuth and I’m consistently getting blocked at the API layer even though the OAuth flow itself is working.
The same token fails across both v2 and v4 API endpoints
Question
Does this indicate that my Frame.io user/workspace is not fully linked or entitled for API access on the backend, even if Adobe login appears to be working in the UI?
If so, what exact account/workspace state should I verify, or what needs to be enabled on your side?
Thanks — trying to determine whether this is still a configuration issue on my end, or whether the account linkage / API entitlement needs support intervention.
Sorry to hear you’re running into some trouble. Based on your description, it doesn’t sound like an issue with the token, especially if it is decoding correctly.
It sounds like you’ve already done this, but something that is always good to check is that you have successfully linked your Adobe and Frame.io accounts. Instructions on how to do so can be found here: Connecting to Adobe authentication | Frame.io V4 Knowledge Center
If that is showing up as successfully linked, the next thing I’d check is the headers. Feel free to send over an example of the requests you’re sending (header included), along with the full response body and I’ll be happy to take a look to troubleshoot further!
Thanks — I dug further and found an important clue.
I tested the built-in API explorer.
I was able to log in successfully and GET /v4/accounts returned 200 with account data, including my account.
I also looked at the explorer’s generated request/code sample and confirmed that the token being used there belongs to a different client_id than my custom Adobe app.
So it appears the built-in explorer is authenticating through a first-party Frame client, while tokens issued to my own custom Adobe app still fail.
@newvisions the built in explorer uses the Adobe Developer Console project that we set up, we did it this way to ensure that people could test their integrations as well as help us troubleshoot issues as they come up (as in your case). It’s no different than how anyone else can set up their own credentials.
The fact that you can get a 200 request on the explorer means there’s some issue in how you’re authenticating or how you’re exchanging the auth token for an access token (since we’ve ruled out general API access).
Can you share the exact code or curl command you’re using to call the API? Specifically:
How you’re doing the token exchange (the full request to the token endpoint, redact the secret)
How you’re attaching the token to your API calls
You can DM me if you’d like if it’s sensitive info.
Also can you confirm these steps are taken correctly?
Confirm the Frame.io API specifically is added to your Adobe Developer Console project.
Credential check — Make sure you’re using the client_id and client_secret from your OAuth Web App credential specifically.
Authorization URL — Confirm you’re passing the correct client_id, redirect_uri, and response_type=code to the Adobe IMS authorize endpoint.
Redirect URI match — The redirect_uri in your auth request must exactly match what’s registered in the Developer Console, including trailing slashes.
Auth code capture — After approval, confirm you’re extracting the code parameter from the redirect correctly.
Token exchange — This is the most common failure point. Confirm you’re POSTing to the Adobe IMS token endpoint with: grant_type=authorization_code, the auth code, client_id, client_secret, and the same redirect_uri used in step 3.
Correct token — The token response returns both an access_token and an id_token. Make sure you’re using the access_token, not the id_token.
Header format — Confirm your Authorization header is exactly Authorization: Bearer <token> — capital B, single space, no extra whitespace or quotes around the token value.
Token freshness — Auth codes expire within minutes. If there’s any delay between getting the code and exchanging it, you may end up with a bad token.
API base URL — Confirm you’re hitting https://api.frame.io/v4/ exactly, not /v2
If you can share the code or curl commands for steps 3, 6, and your actual API call (redact the secret), that’ll help us spot where it’s breaking down.
hi @newvisions it’s a timed thing (since you are a new user) just takes a few days to validate or a few posts. Should unlock soon-ish. Was implemented a while back since we had users getting spammed by bots