ruby - Can't get access token for ExactOnline with OAuth -

i'm following oauth tutorial here access code in order authenticate api requests online accounting software exact online.

however, i'm stuck @ step 3, use authorization code returned in step 2 obtain access token.

here's i'm trying:

require 'httparty'  exact_client_id = '<redacted>' exact_client_secret = '<redacted>' exact_server_base_url = 'https://start.exactonline.nl' exact_auth_code = '<redacted>'  response = httparty.post("#{exact_server_base_url}/api/oauth2/token", headers: {'content-type' => 'application/x-www-form-urlencoded'}, query: {code: exact_auth_code, redirect_uri: 'http://<redacted>.runscope.net/', grant_type: 'authorization_code', client_id: exact_client_id, client_secret: exact_client_secret})  puts response # => 'bad request'  puts response.code # => 400 

i don't understand why happening. when looking @ list of response codes here, code means:

the request not understood server due malformed syntax. client should not repeat request without modifications.

what doing wrong?

update #1:

i've tried:

response_2 = httparty.post("#{exact_server_base_url}/api/oauth2/token", :headers => {'content-type' => 'application/x-www-form-urlencoded'}, :body => {'code' => exact_auth_code, 'redirect_uri' => 'http://<redaced>.runscope.net/', 'grant_type' => 'authorization_code', 'client_id' => exact_client_id, 'client_secret' => exact_client_secret}) 

but response same.

even though using http post method you're providing values query parameters supplying them query: parameter .post method. instead should provide them in body: parameter, see: how can implement post request using httparty?

also syntax re. body: :body should fixed, like:

response_2 = httparty.post("#{exact_server_base_url}/api/oauth2/token", :headers => {'content-type' => 'application/x-www-form-urlencoded'}, :body => {'code' => exact_auth_code, 'redirect_uri' => 'http://<redaced>.runscope.net/', 'grant_type' => 'authorization_code', 'client_id' => exact_client_id, 'client_secret' => exact_client_secret}) 

last not least: code value one-time usage , has short lifetime; make sure use freshly obtained one.