# OAuth2 error: unauthorized_client

- **ID:** `api/oauth2-unauthorized-client`
- **Domain:** api
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The client_id or client_secret provided in the OAuth2 token request is not registered or is disabled for the requested grant type.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth2 RFC 6749 | active | — | — |
| OAuth2 RFC 6750 | active | — | — |

## Workarounds

1. **Verify the client_id and client_secret in the OAuth2 provider's dashboard. Ensure the client is enabled and the correct grant type (e.g., authorization_code, client_credentials) is allowed. Example: curl -X POST https://auth.example.com/token -d 'grant_type=client_credentials&client_id=valid_client&client_secret=valid_secret'** (90% success)
   ```
   Verify the client_id and client_secret in the OAuth2 provider's dashboard. Ensure the client is enabled and the correct grant type (e.g., authorization_code, client_credentials) is allowed. Example: curl -X POST https://auth.example.com/token -d 'grant_type=client_credentials&client_id=valid_client&client_secret=valid_secret'
   ```
2. **Check the provider's documentation for required scopes or additional parameters. Add missing scopes: POST /token with scope=openid profile** (50% success)
   ```
   Check the provider's documentation for required scopes or additional parameters. Add missing scopes: POST /token with scope=openid profile
   ```

## Dead Ends

- **** — Regenerating the client_secret without updating the application configuration will not resolve the issue if the client_id is incorrect or the grant type is not allowed. (40% fail)
- **** — Whitelisting the IP address of the client server does not address the root cause of an invalid client registration. (30% fail)