Unsupported Grant Type

URI: https://docs.ankatech.co/errors/unsupported_grant_type
HTTP Status: 400 Bad Request

This error also corresponds to the RFC 6749 OAuth 2.0 error code unsupported_grant_type of the same name. The RFC 9457 type suffix uses the identical underscore form so the two identifiers match.

When you see this

The token endpoint (POST /api/v3/auth/token) does not admit the grant_type of the request. The admitted grants are:

No person signs in with a password at the token endpoint. The resource owner password credentials grant (grant_type=password) and the tenant-selection grant (urn:ankatech:params:oauth:grant-type:tenant-selection) receive this answer for every caller and every credential: a correct password, a wrong one, an unknown user, a platform identity and a break-glass member all get the same body. The request is refused before any credential is read, so no failed sign-in is counted and no account is locked. RFC 9700 §2.4 states that the password grant must not be used.

Common Causes

• A client still signs a person in with grant_type=password (an Admin SDK, SDK or Admin CLI release earlier than 3.3.0, or a script).
• A client still redeems a tenant selection with the tenant-selection grant.
• A typo in the grant_type value, or a grant the platform does not implement (for example implicit).

Response Example

{
  "error": "unsupported_grant_type",
  "error_description": "Grant type 'password' is not supported. Allowed values: authorization_code, client_credentials, refresh_token, urn:ietf:params:oauth:grant-type:token-exchange",
  "error_uri": "https://docs.ankatech.co/errors/unsupported_grant_type",
  "type": "https://docs.ankatech.co/errors/unsupported_grant_type",
  "title": "Unsupported Grant Type",
  "status": 400,
  "detail": "Grant type 'password' is not supported. Allowed values: authorization_code, client_credentials, refresh_token, urn:ietf:params:oauth:grant-type:token-exchange",
  "instance": "/api/v3/auth/token",
  "timestamp": 1730000000
}

Content-Type: application/json — not application/problem+json. RFC 6749 §5.2 defines the token endpoint's error response, and the Auth API emits that shape deliberately: the RFC 9457 members ride along for clients that read them, but no RFC 9457 media type or envelope is emitted on this endpoint. Switch on the status and the error member, never on the media type.

The Auth API carries no correlation member in the body: correlate through the X-Correlation-Id response header instead. See Error Index & Overview.

How to Resolve

1. A person signs in through the sign-in transaction, in the console. See Authentication Architecture^*.
2. A program that administers the platform unattended authenticates as an administrative workload (client_credentials with a DPoP proof). See Administrative Workload Identity^*.
3. A program that performs cryptographic operations authenticates as a cryptographic actor (client_credentials).
4. Otherwise, check the grant_type spelling against the list above and the Developer Hub Reference.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.