# Question about keyid and verification code

**URL:** <https://forums.eveonline.com/t/question-about-keyid-and-verification-code/29505>\
**Category:** Third Party Developers\
**Created:** [October 5, 2017, 5:07am UTC](https://forums.eveonline.com/t/question-about-keyid-and-verification-code/29505 "2017-10-05T05:07:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yumoen\_Crisam](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/yumoen_crisam/32/29365_2.png) [@Yumoen\_Crisam](https://forums.eveonline.com/u/Yumoen_Crisam)\
**Post date:** [October 5, 2017, 5:07am UTC](https://forums.eveonline.com/t/question-about-keyid-and-verification-code/29505/1 "2017-10-05T05:07:02Z")

</div>

I’m trying to authenticate a user’s keyid and verification code, but I keep getting:

```auto
{"error":"invalid_request","error_description":"Invalid authorization code, decrypt failed"}

```

Hitting [https://login.eveonline.com/oauth/token](https://login.eveonline.com/oauth/token)

The naming in the docs is throwing me off. Is the `code` field the same thing as the “Verification Code” on the mange API access page? I’m trying to avoid logging in and get an auth token manually. Where does the “Key ID” come in to play?

Also, just to be sure. The Authorization is `Basic base64(client id:secret key)` right? Again, naming and docs do not match.

---

<div class="post-metadata">

**Author:** ![Scipio\_Artelius](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/scipio_artelius/32/408264_2.png) [@Scipio\_Artelius](https://forums.eveonline.com/u/Scipio_Artelius)\
**Post date:** [October 5, 2017, 6:34am UTC](https://forums.eveonline.com/t/question-about-keyid-and-verification-code/29505/2 "2017-10-05T06:34:17Z")

</div>

You don’t oauth against the API key.

If you specifically want to use an api key (keyID and verification code), then see this page:

[http://eveonline-third-party-documentation.readthedocs.io/en/latest/xmlapi/authentication.html](http://eveonline-third-party-documentation.readthedocs.io/en/latest/xmlapi/authentication.html)

If you want to use oauth, then you need to use the SSO and apply different scopes to your application so that the user authorizes access to that information (you don’t use the keyID and vcode supplied by a user).

Documentation on the SSO flow (explicit and implicit) is here:

[http://eveonline-third-party-documentation.readthedocs.io/en/latest/sso/index.html](http://eveonline-third-party-documentation.readthedocs.io/en/latest/sso/index.html)

Note, the XML API is deprecated and will close by 8 May next year (possibly earlier).

---

<div class="post-metadata">

**Author:** ![Yumoen\_Crisam](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/yumoen_crisam/32/29365_2.png) [@Yumoen\_Crisam](https://forums.eveonline.com/u/Yumoen_Crisam)\
**Post date:** [October 5, 2017, 1:40pm UTC](https://forums.eveonline.com/t/question-about-keyid-and-verification-code/29505/3 "2017-10-05T13:40:55Z")

</div>

Yep, that worked out well. I don’t know what I was thinking. Thanks for setting me straight.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/eveonline/original/3X/4/1/41ec4921cbaca7a6f9ea556e7cc20018461eae5e.png) [@system](https://forums.eveonline.com/u/system)\
**Post date:** [January 3, 2018, 1:41pm UTC](https://forums.eveonline.com/t/question-about-keyid-and-verification-code/29505/4 "2018-01-03T13:41:20Z")

</div>

Closed on January 3, 2018, 1:41pm UTC

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.