# IndieAuth Token Exchange grant_type Fix

**Date**: 2025-11-22
**Version**: 0.9.3
**Type**: Bug Fix

## Summary

Added the required `grant_type=authorization_code` parameter to the IndieAuth token exchange request.

## Problem

The token exchange request in `starpunk/auth.py` was missing the `grant_type` parameter. Per OAuth 2.0 spec (RFC 6749 Section 4.1.3), the token exchange request MUST include:

```
grant_type=authorization_code
```

Some IndieAuth providers that strictly validate OAuth 2.0 compliance would reject the token exchange request without this parameter.

## Solution

Added `"grant_type": "authorization_code"` to the `token_exchange_data` dictionary in the `handle_callback` function.

### Before

```python
token_exchange_data = {
    "code": code,
    "client_id": current_app.config["SITE_URL"],
    "redirect_uri": f"{current_app.config['SITE_URL']}auth/callback",
    "code_verifier": code_verifier,
}
```

### After

```python
token_exchange_data = {
    "grant_type": "authorization_code",
    "code": code,
    "client_id": current_app.config["SITE_URL"],
    "redirect_uri": f"{current_app.config['SITE_URL']}auth/callback",
    "code_verifier": code_verifier,
}
```

## Files Modified

1. **`starpunk/auth.py`** (line 412)
   - Added `"grant_type": "authorization_code"` to token_exchange_data

2. **`starpunk/__init__.py`** (line 156)
   - Version bumped from 0.9.2 to 0.9.3

3. **`CHANGELOG.md`**
   - Added 0.9.3 release notes

## Testing

- Module imports successfully
- Pre-existing test failures are unrelated (OAuth metadata and h-app tests for removed functionality)
- No new test failures introduced

## References

- RFC 6749 Section 4.1.3: Access Token Request
- IndieAuth specification
