Skip to content

Invalid Client

URI: https://docs.ankatech.co/errors/invalid_client
HTTP Status: 401 Unauthorized

This error also corresponds to the RFC 6749 OAuth 2.0 error code invalid_client of the same name. The RFC 9457 type suffix uses the identical underscore form so the two identifiers match.

When you see this

Client authentication at the token endpoint failed — the client identity could not be verified.

Common Causes

  • An unknown or disabled client_id.
  • Missing or incorrect client credentials.
  • Using an unsupported client authentication method.
  • An administrative workload (a request with a DPoP header) that is unknown, suspended or revoked, whose key is revoked, expired or past its rotation grace, whose assertion signature fails or was already used, or whose federated subject is not bound. Every one of these answers the same body.
  • A workload credential sent without a DPoP header, or a cryptographic actor's assertion sent with one: a workload never obtains a Bearer token.

Response Example

{
  "error": "invalid_client",
  "error_description": "Client authentication failed. The client could not be verified.",
  "error_uri": "https://docs.ankatech.co/errors/invalid_client",
  "type": "https://docs.ankatech.co/errors/invalid_client",
  "title": "Invalid Client",
  "status": 401,
  "detail": "Client authentication failed. The client could not be verified.",
  "instance": "/api/v3/auth/token",
  "timestamp": 1730000000
}

Content-Type: application/json — not application/problem+json. RFC 6749 §5.2 defines the token endpoint's error response, and the Auth API emits that shape deliberately: the RFC 9457 members ride along for clients that read them, but no RFC 9457 media type or envelope is emitted on this endpoint. Switch on the status and the error member, never on the media type.

The Auth API carries no correlation member in the body: correlate through the X-Correlation-Id response header instead. See Error Index & Overview.

How to Resolve

  1. Verify the client_id and client secret (or other client credentials).
  2. Confirm the client is registered and enabled.
  3. Use a supported client authentication method and re-submit.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.