Hello!

I’m implementing ID/Key authentication for a Python script and am running into a few issues I could use some help with. I know OAuth2.0 is the new standard, but for now I'm just trying to make simple API requests and I believe this route will suffice.

Issue 1: Redirect to 404 after login (no callback)

• My script opens auth at: /d2l/auth/api/token with parameters x_a (App ID), x_d (app signature HMAC of GET&/d2l/auth/api/token&timestamp), x_t (timestamp), x_target (http://localhost:8080/callback)
• Login page shows the target correctly (Brightspace double-encodes the target as expected), but after login I’m redirected to https:///d2l/error/404 and my callback never receives a request
• Manually visiting /d2l/auth/api/token returns 404 unless parameters are provided (expected), but even with parameters the post-login flow still 404s
• App ID/Key and Trusted URL are correct; clock is in sync

Issue 2: 403 Invalid token when using API Test Tool’s user context

• As a workaround, I authenticated via the official API Test Tool and captured the returned x_a (App ID), x_b (User ID), x_c (User Key) values
• I placed x_b (user_id) and x_c (user_key) into my script, set host, and used the matching App ID/Key for that app
• My request signing for API calls is:
  • app_sig = HMAC(App Key, "GET&&")
  • user_sig = HMAC(User Key, "GET&&")
  • Query params: x_a (App ID), x_b (User ID), x_c (user_sig), x_d (app_sig), x_t (timestamp)
• Calling /d2l/api/lp/1.53/users (and also tried with/without trailing slash) returns 403 Forbidden: Invalid token
• I also tried calling /d2l/api/lp/1.53/users/whoami first and still get 403

Questions

1. For the ID/Key login flow to /d2l/auth/api/token, what would cause a 404 immediately after login instead of redirecting to x_target? Is there a required configuration, permission, or alternate auth path for some tenants?
2. For the API call signing, are there tenant-specific requirements around:
   • exact path string (with vs without trailing slash) used in the signature versus the request?
   • using the User Key from the callback to compute x_c (user_sig) each request (not reusing the literal x_c returned)?
3. Any known differences between the test tool’s flow (which uses x_b in the auth URL) versus the signature-based x_d/x_t flow that could explain the behavior?

Any guidance or pointers, or even drop-in python scripts of up-to-date ID/Key auth examples would be greatly appreciated. Thank you!