Okta returns an error when a POST request to the Okta /oauth2/v1/token endpoint or a custom authorization server's token endpoint (for example, /oauth2/default/v1/token) is made to request tokens. This issue occurs because the client credentials included in the request are incorrect, improperly formatted, or do not match the configured application method in Okta. Resolve this by verifying the application credentials and client authentication method in the Okta Admin Console to ensure they match the information in the API request.

invalid_client: error_description: "Client authentication failed. Either the client or the client credentials are invalid"

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OAuth 2.0 / OpenID Connect (OIDC)

This error indicates that the credentials that authenticate the client application are incorrect, improperly formatted, or do not match the configured method for the application in Okta. Client credentials consist of the client_id and client authentication (for example, client_secret or client assertion token).

Common causes include:

• The client_id and client_secret lack correct formatting in the Authorization header (for example, lacking proper Basic Auth encoding).
• The client authentication method in the request (for example, client_secret_basic, client_secret_post) does not match the Client authentication setting for the application in the Okta Admin Console.

What steps verify the application credentials and client authentication method?

Verify the application credentials and client authentication method in the Okta Admin Console to ensure they match the information in the API request.

1. Sign in to the Okta Admin Console.
2. Navigate to Applications > Applications and select the OAuth 2.0 / OIDC application experiencing the issue.
3. In the General tab, find the Client Credentials section.
4. Locate the Client authentication setting and note the selected method (for example, Public key / Private key).
5. Format the API request to the /token endpoint correctly based on the configured authentication method.
   • For Client Secret, set the Authorization header to Basic followed by a base64-encoded string of client_id:client_secret.
     NOTE: If the Management API created the application, Client Secret might require parameters in the body or an assertion token instead of a secret.
   • For Public key / Private key, provide the client authentication as a client assertion token.

Related References

• Client authentication methods | Okta Developer