Well, bad code doesn't pay.
What I didn't mention was that the site I'm trying to deploy is an attempt to move a domain over to a new server. Both the broken site and it's active sister site have the same domain name. This is the code that posts to my own domains /oauth/token endpoint:
$username = Input::json('username');
$password = Input::json('password');
$page = Input::get('page');
$client = Client::find(2);
$http = new GuzzleHttp\Client();
try {
$response = $http->post(url('oauth/token'), [ # <-- see the problem?
'form_params' => [
'grant_type' => 'password',
'client_id' => '2',
'client_secret' => $client->secret,
'username' => $username,
'password' => $password,
'scope' => '',
],
]);
#...
The problem is rather hilarious. Since the DNS hasn't switched for the site yet, the requests to my own site are going to the old site, not this one. Hence I'm getting back Unauthenticated. Because I'm not.
The solution was to edit the /etc/hosts file on the server to point the domain to itself. That way, any calls to its own api will actually go its own api. Problem solved.
So, moral of the story: if you need to post to your own api, make sure your /etc/hosts file will direct your calls back to yourself.
