We have a developed a web application that uses spring security. Recently, we extended the options to include OAuth2. We chose an implementation approach to be vendor agnostic and does not include the vendor boot starter projects. Internally we tested against Okta Developer Edition and Entra ID and it worked as expected.

However when we rolled out to a client with a production version of Okta (version unknown), the authentication failed in the request for tokens. I see the following request when I call the Okta Developer Edition :

HTTP POST https://XXXXX/oauth/token
      Accept=[application/json, application/*+json]
      Writing [{grant_type=[authorization_code], code=[XXXXXXXXXXXXXX], redirect_uri=[http://xxxxxx/login/oauth2/code/okta/]}] as "application/x-www-form-urlencoded;charset=UTF-8"
Response 200 OK 

The same code at the client site is generating the following request:

HTTP POST https://XXXX/oauth2/XXXX/v1/token
      Accept=[application/json, application/*+json]
      Writing [{grant_type=[authorization_code], code=[xxxx], redirect_uri=[https://xxxx/login/oauth2/code/okta/]}] as "application/x-www-form-urlencoded;charset=UTF-8"
Response 401 UNAUTHORIZED

I understand that spring classes are using the standard OAuth2 URI’s to get the endpoints to invoke. I am just wondering what is causing the differences and how to resolve the issue.