Cannot authorize indiebookclub: Invalid iss parameter

[jackdbd]

Summary

I cannot authorize Indiebookclub at my authorization endpoint because of this error:

The authorization server returned an invalid iss parameter (invalid_iss)

Here is what I did

I entered my me URL (https://giacomodebidda.com) in the Web Sign-In bar and got redirected to the consent screen on my authorization endpoint.

I clicked Approve the request and then I immediately got this error from Indiebookclub.

Additional details

I am still working on my authorization endpoint, so I am not sure whether the fault is mine or not, but I tested the same authorization workflow with Quill and another Micropub client that I am implementing, and it works.

In case it might be useful, the iss parameter my authorization endpoint is returning is a URL, as it is specified in the IndieAuth protocol.

I am also storing the authorization codes in a Turso database. I can paste a couple of examples here, since these codes are long expired.

[
  {
    "id": 51,
    "code": "6965acf4396db95b4055ca984959d3d6",
    "client_id": "https://indiebookclub.biz/id",
    "code_challenge": "MeSgzyas6WCgYRAopyO0ozTNR_A80rZOZmGRRx8ZGiU",
    "code_challenge_method": "S256",
    "exp": 1739568354,
    "iss": "https://micropub.fly.dev",
    "me": "https://giacomodebidda.com/",
    "redirect_uri": "https://indiebookclub.biz/auth/callback",
    "scope": "create draft profile",
    "used": 0,
    "created_at": 1739568295001,
    "updated_at": 1739568295001
  },
  {
    "id": 50,
    "code": "21cfb49ffa1d94132771f39810ba4d4e",
    "client_id": "https://quill.p3k.io/",
    "code_challenge": "oC5pHz80Psxl52RDGpImBp8PC1-73ry2aVqSM9kkswo",
    "code_challenge_method": "S256",
    "exp": 1739567715,
    "iss": "https://micropub.fly.dev",
    "me": "https://giacomodebidda.com/",
    "redirect_uri": "https://quill.p3k.io/auth/callback",
    "scope": "create media profile update",
    "used": 1,
    "created_at": 1739567655560,
    "updated_at": 1739567656200
  }
]

As you can see, the authorization code issued at the beginning of the indiebookclub authorization workflow has "used": 0, so it was never used. On the other hand, the authorization did succeed with Quill, in fact the code has "used": 1.

[gRegorLove]

Thanks for reporting! Things look correct at a quick glance of your indieauth-metadata, though I'll take a closer look.

One thing I'm not sure about (but could just be a detail of your database records) the iss in those is https://micropub.fly.dev instead of the https://giacomodebidda.com/ that's in your metadata?

When your authorization endpoint redirects back to indiebookclub, is it including query parameter iss=https://giacomodebidda.com/ ?

[gRegorLove]

I believe Quill still needs to be updated to use the indieauth-metadata endpoints and the issuer-verification that goes along with them (via the indieauth-client-php lib). I suspect that's why Quill is working for you.