invalid_
Registry Context
`invalid_client` indicates that client authentication failed.
Technical Summary
RFC 6749 Section 5.2 defines `invalid_client` as an error code in token endpoint error responses. It also specifies HTTP 401 and `WWW-Authenticate` handling for certain client authentication failures.
When Used
When client authentication fails, including for an unknown client, omitted client authentication, or an unsupported authentication method.
Normative Requirements
Authorization servers
RFC 6749 - Section 5.2
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter value.
Condition: when returning the `error` parameter
Values for the "error" parameter MUST NOT include characters outside the set
RFC 6749 - Section 5.2
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error_description` parameter value.
Condition: when including `error_description`
Values for the "error_description" parameter MUST NOT include characters outside the set
RFC 6749 - Section 5.2
include characters outside `%x21 / %x23-5B / %x5D-7E` in the `error_uri` parameter value.
Condition: when including `error_uri`
MUST NOT include characters outside the set
RFC 6749 - Section 5.2
respond with HTTP 401 Unauthorized and include a `WWW-Authenticate` response header matching the authentication scheme used by the client.
Condition: if the client attempted authentication through the `Authorization` request header field
authorization server MUST respond with an HTTP 401
RFC 6749 - Section 5.2
ensure the `error_uri` value conforms to URI-reference syntax.
Condition: when including `error_uri`
Values for the "error_uri" parameter MUST conform to the URI-reference syntax
RFC 6749 - Section 5.2
include an `error` parameter containing a single ASCII error code.
Condition: when returning a token endpoint error response
error REQUIRED. A single ASCII error code
RFC 6749 - Section 5.2
return HTTP 401 Unauthorized to indicate which HTTP authentication schemes are supported.
Condition: when returning an `invalid_client` error
authorization server MAY return an HTTP 401
RFC 6749 - Section 5.2
include an `error_description` parameter containing human-readable ASCII text that assists the client developer.
Condition: when returning a token endpoint error response
error_description OPTIONAL
RFC 6749 - Section 5.2
include an `error_uri` identifying a human-readable web page with information about the error.
Condition: when returning a token endpoint error response
error_uri OPTIONAL
Validation Guidance
Verify that a token endpoint error response includes an `error` parameter containing a single ASCII error code.
Verify that `invalid_client` is used for a client authentication failure, such as an unknown client, omitted authentication, or an unsupported authentication method.
If the client attempted authentication through the `Authorization` header, verify that the response status is 401 and `WWW-Authenticate` matches the authentication scheme used.
If HTTP 401 is otherwise used for `invalid_client`, verify that it indicates supported HTTP authentication schemes.
Verify that the `error` value contains only characters from `%x20-21 / %x23-5B / %x5D-7E`.
If `error_description` is present, verify that it contains only characters from `%x20-21 / %x23-5B / %x5D-7E`.
If `error_uri` is present, verify that it is a valid URI-reference and contains only characters from `%x21 / %x23-5B / %x5D-7E`.
Verify that response parameters are serialized as a top-level JSON object using the `application/json` media type.
Reference
Details
- Entry Id
invalid_client - Name
invalid_client - Usage Location
token endpoint, authorization endpoint- Protocol Extension
OAuth 2.0 Authorization Framework- Change Controller
IETF- Reference
RFC6749