Hi Navigraph team,
We’re integrating Navigraph sign-in through the Device Authorization flow with PKCE, and we’ve hit a wall we haven’t been able to get past on our own. We’d really appreciate any pointers.
What we’re seeing
- POST https://identity.api.navigraph.com/connect/deviceauthorization with our client ID, client secret, code_challenge + code_challenge_method=S256, and the scopes openid fmsdata offline_access returns HTTP 401 {“message”:“Unauthorized”}.
- Requesting only the openid scope gives the same 401.
- We copied the client secret straight from the 1password portal with its Copy button. We also tried it outside our application with a plain curl request, and got the same response.
- Leaving the secret out returns “client_secret must not be empty”, and leaving PKCE out returns “code_challenge must not be empty”, so the request seems to be reaching the endpoint as expected.
Error IDs, in case they’re useful
- 5673b4f5fdb640d495ad077019a13f4c (12 October 2026)
- 6feb90ed1cfa4887bcf5f90fae22beec (12 October 2026)
- c7c6615571eb4450b5273d4f070497fd (12 October 2026)
We may well be missing a step in the setup, so if anyone has run into something similar, or knows of anything else that needs to be done before a Device Flow client can sign in, we’d love to hear it.
We also emailed dev@navigraph.com on 2 October and 7 October, and we understand the team may be busy. If someone from Navigraph could take a look when they have a moment, we’re happy to share the client details privately.
Thanks a lot for your help!