I have a code that redirects users to the launch page and I’m getting the Authorization Code for an Access Token.
Epic document mentioned 2 methods for getting the access token.

1. If You Are Not Using a Client Secret – this code is working successfully
   but as I want a refresh token too that’s why I have to use 2nd method
2. on the second method document mentioned passing Authorization with a header
   I’m following the same method but still getting the client_invalid

I think the error happened because of the wrong Authorization but as per the document i pass the every parameters and data

let data = {
    grant_type: "authorization_code",
    code: code,
    redirect_uri: redirectUri,
  };

  const body = encode(data);
  const authHeader = 'Basic ' + base64url.encode(`${clientId}:${encodeURIComponent(clientSecret)}`);

  const config = {
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      "Authorization": authHeader,
    },
  };

  try {
    const response = await axios.post(
      "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token",
      body,
      config
    );
    return response.data;
  } catch (error) {
    console.error(
      "Token Exchange Request Error:",
      error.response ? error.response.data : error.message
    );
    throw error;
  }