An OpenID Connect (OIDC) authentication flow fails with a 400 Bad Request error and no detailed description due to a misconfigured authorize URL or application setting in Okta. Verify the application status and ensure the client ID matches the Okta organization domain exactly to resolve this issue. During an attempt to initiate an OIDC authentication flow, Okta redirects to the /authorize endpoint, and the following error message appears without a detailed description:

400 Bad Request

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC) Application

A misconfiguration in the authorize URL or within the application settings in Okta invalidates the authorization request. If no error description appears on the page, Okta does not recognize the provided redirect_uri, or an issue exists with the client_id.

NOTE: Okta does not generate System Log events for this specific error. Only the end user sees this error message in the browser.

What steps resolve the 400 Bad Request error?

Verify the application status in the Admin Console and confirm the client ID configuration matches the request parameters exactly.

1. Verify the application status in the Admin Console.
2. Ensure the OIDC application status is Active.
3. Verify that the request provides the valid client_id.
4. Confirm the client_id belongs to the specific Okta organization subdomain where the request originates.
5. Ensure the client_id matches the value in the Admin Console exactly, as these values are case-sensitive.
6. Verify that no extraneous spaces exist in the client_id or other request parameters.
7. Check that the client_id state is Active.

Related References

• Error "400 Bad Request" - The redirect_uri Parameter Must Be a Login Redirect URI in the Client App Settings