Okta HTTP "400 Bad Request" Error Occurs During Request to OpenID Connect Token Endpoint

During a redirect to the /oauth2/v1/token endpoint, the authentication flow fails, and Okta returns the following HTTP error:

400 Bad Request

This error occurs because an out-of-sync device clock invalidates the JSON Web Token (JWT). To resolve this, correct the device system time to ensure the clock is fully synchronized and up to date. When this error occurs, the Okta System Log displays no detailed description, but reviewing the network activity in the browser (for example, using the Network panel in Chrome) or a Hypertext Transfer Protocol Archive (HAR) trace reveals the following error:

"error_description": "The DPoP proof JWT is issued more than X minutes in the past."

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• /oauth2/v1/token Endpoint

An out-of-sync device clock invalidates the JSON Web Token (JWT) during the request to the /oauth2/v1/token endpoint. This results in the HTTP 400 Bad Request error because the DPoP proof JWT is issued more than <X> minutes in the past.

How is the HTTP 400 Bad Request error resolved?

Correct the device system time to ensure the clock is fully synchronized and up to date.