unauthorizedclient

unauthorizedclient, typically rendered as the OAuth 2.0 error code unauthorized_client, refers to a condition where a client is not authorized to request an authorization code or access token. The error is defined in RFC 6749 and is returned by the authorization server when a request cannot be fulfilled due to client-level restrictions. In responses, the server often uses HTTP 400 and includes error parameters such as error=unauthorized_client and optional error_description and error_uri.

This error commonly occurs during requests to the authorization endpoint or the token endpoint. It can indicate that the client is not registered to use the requested grant type, that the redirect_uri is not registered or does not match the one provided, or that the client_id is invalid or not permitted to perform the operation. The error may also surface when a client attempts to use an authentication method or flow that is not supported or properly configured on the server.

Causes include a misconfigured client registration, such as missing or disallowed grant types, incorrect or mismatched redirect URIs, or improper client authentication. PolicyRestrictions at the authorization server can also trigger this error if the client is explicitly blocked from certain operations.

Resolution involves reviewing and updating the client’s registration: ensure the correct grant types are enabled, the redirect URIs are accurate and registered, and that the client_id (and client_secret, where applicable) are valid. If PKCE is required, ensure it is properly implemented. Consult server logs and provider documentation or contact the authorization server administrator to adjust the client’s configuration.

In OpenID Connect and other OAuth 2.0 deployments, unauthorized_client is one of the standard error responses used to indicate client-specific authorization failures.