Skip to content

Menu AuthGuardHelp centre

Troubleshooting · OpenID Connect

OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)

1 min read
SaaS · Self-hosted

What does the user see?

«The request expired or was opened in another browser. Go back to the service and try again.»: you opened the sign-in link in another browser, or took too long. Go back to the application and start again.
An error page without returning to the application: the redirect address or the client is not registered (a configuration problem; contact your administrator).
The application says access was denied (access_denied): the access policy does not allow this sign-in.

Errors the application receives

Code	Likely cause	What to do
Error page, no redirect	Unknown `client_id`, or `redirect_uri` missing or different from the registered «Redirect URIs»	Register the exact address (scheme, host, port and path)
`invalid_client` (401)	Wrong, rotated or expired secret; client authentication method differs from the registered one	Update the secret; check the method
`invalid_grant`	Authorization code already used, expired, from another client, or wrong PKCE `code_verifier`; refresh token revoked	Repeat the sign-in; do not reuse codes
`unauthorized_client` / `unsupported_grant_type`	The client may not use this grant type	Review the service configuration
`invalid_scope`	Scope not allowed for the client	Ask only for the configured scopes
`login_required` / `interaction_required`	A `prompt=none` request with no usable session	Repeat without `prompt=none`
`invalid_dpop_proof` / `use_dpop_nonce`	Invalid DPoP proof, or the server asks for a nonce	Repeat with the nonce received
`temporarily_unavailable`	The service is busy or in maintenance	Try later

When to escalate

With repeated invalid_client after rotating the secret, check that every instance of the application uses the new secret. If it persists, contact support with the client identifier and the time, never with the secret.

Error codes in this article

Article referencets-oidc-errorsquote it to support to identify this article. Checked against the product at commit 5f6607a8.