invalidclient

invalidclient is the term used to describe an OAuth 2.0 and OpenID Connect error indicating that the client authentication has failed or the client is not permitted to use the requested grant type. The standard error code is invalid_client, and it is defined in RFC 6749 as the response when a token request cannot be authenticated or the client is not recognized or authorized for the operation.

In practice, invalid_client arises at the token endpoint when a client attempts to obtain tokens and the server cannot verify the client's identity. This can occur for reasons such as an unknown or unregistered client_id, invalid client_secret, or the use of an authentication method that the authorization server does not support for that client. The error is typically conveyed in a JSON error response that includes error=invalid_client and may include error_description and error_uri for further details. HTTP status codes associated with invalid_client are commonly 400 Bad Request or 401 Unauthorized, and some implementations may use a WWW-Authenticate header to indicate the need for proper client authentication.

Common causes include incorrect client credentials, a mismatch between the registered redirect_uri and the one used in the request, attempting a grant type that the client is not allowed to use, or insecure or unsupported authentication methods. To resolve invalid_client, developers should verify the client’s registration details, ensure the correct client_id and client_secret are used, confirm that the requested grant type is permitted for the client, and validate redirect URIs. Security best practices include using TLS, rotating credentials if needed, and ensuring that confidential client credentials are not exposed.

See also: OAuth 2.0 error handling, RFC 6749, token endpoint, client authentication.