An invalid client error occurs on the authorization server token endpoint because the request includes an Origin header, which indicates a client-side request requiring Proof Key for Code Exchange (PKCE). Resolve this error by implementing Authorization Code Flow with PKCE for client-side requests or by removing the Origin header for server-side requests. Okta returns the following error on the /token endpoint of the authorization server during an Authorization Code Flow, Client Credentials Flow, or Resource Owner Password Flow:

{
    "error": "invalid_client",
    "error_description": "Browser requests to the token endpoint must use Proof Key for Code Exchange."
}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect
• OAuth 2.0
• Authorization Code Flow

The request to the /token endpoint of the authorization server contains the Origin header.

Why does the token endpoint require Proof Key for Code Exchange?

The Origin header designates client-side requests. Okta requires PKCE if the /token request originates on the client side. Authorization Code Flow with PKCE is the only client-side OIDC flow that supports the /token endpoint of the authorization server.

Server-side Requests Require the Removal of the Origin Header

Ensure successful token endpoint requests by applying the correct configuration for the specific flow type.

• Implement Authorization Code Flow with PKCE for client-side OIDC flows that use the /token endpoint.
• Send requests through a server-side or native method for all other OIDC flows.
• Omit the Origin header in the /token request for server-side or native methods.

NOTE: The browser version of the Postman application automatically adds the Origin header to the payload. Verify the absence of the Origin header in the /token call when using the browser version of Postman.

Related References

• Implement the Authorization Code with PKCE Flow
• Client Authentication Methods
• Choosing the Right OAuth 2.0 Grant or OIDC Flow
• Disabling PKCE on an OIDC Client