# Getting "invalid\_grant" during client token request using authorization code

**URL:** <https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042>\
**Category:** Securing applications\
**Tags:** authentication, oidc\
**Created:** [April 7, 2020, 8:12pm UTC](https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042 "2020-04-07T20:12:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![arozar](https://avatars.discourse-cdn.com/v4/letter/a/2bfe46/32.png) [@arozar](https://forum.keycloak.org/u/arozar)\
**Post date:** [April 7, 2020, 8:12pm UTC](https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042/1 "2020-04-07T20:12:41Z")

</div>

I’m following the implementer’s guide from [https://openid.net/specs/openid-connect-basic-1\_0.html](https://openid.net/specs/openid-connect-basic-1_0.html). I’m trying to use the authorization code that is presented to the end-user after login. According to 2.1.6.1. Client Sends Code I should be able to POST to “/auth/realms/{realm}/protocol/openid-connect/token” with the following parameters `grant_type` and `code`. I’m getting the error invalid\_grant with the description of “Code not valid”. It seems like an easy fix except that I’m using the code from the authentication response.

Authentication 302 response:  
`Location: http://IPADDR:PORT/?session_state=a73add8c-2404-4d25-8d58-f7a9bd81b041&code=0668a692-e80e-4835-8244-ea6d76e17307.a73add8c-2404-4d25-8d58-f7a9bd81b041.6c9bd3fc-908a-40fe-b581-18b2c1316594`

```
POST to validate:
POST /auth/realms/{realm}/protocol/openid-connect/token HTTP/1.1
Host: IPADDR:8443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 240
Origin: https://IPADDR:8443
Authorization: Basic BASE64ENCODED(CLIENT_ID:SECRET)

grant_type=authorization_code&code=0668a692-e80e-4835-8244-ea6d76e17307.a73add8c-2404-4d25-8d58-f7a9bd81b041.6c9bd3fc-908a-40fe-b581-18b2c1316594
```

---

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.keycloak.org/u/Robinyo)\
**Post date:** [April 7, 2020, 9:44pm UTC](https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042/2 "2020-04-07T21:44:56Z")

</div>

See: [Getting started with Keycloak](https://robferguson.org/blog/2019/12/24/getting-started-with-keycloak/)

---

<div class="post-metadata">

**Author:** ![arozar](https://avatars.discourse-cdn.com/v4/letter/a/2bfe46/32.png) [@arozar](https://forum.keycloak.org/u/arozar)\
**Post date:** [April 8, 2020, 12:42pm UTC](https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042/3 "2020-04-08T12:42:39Z")

</div>

Thanks I’ll check it out!

---

<div class="post-metadata">

**Author:** ![iliasvlachos](https://avatars.discourse-cdn.com/v4/letter/i/dec6dc/32.png) [@iliasvlachos](https://forum.keycloak.org/u/iliasvlachos)\
**Post date:** [November 3, 2020, 1:47pm UTC](https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042/4 "2020-11-03T13:47:23Z")

</div>

Dear @arozar I’m getting the same error when using authorization\_code as the grant\_type. Did you solve your problem?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![pmorch](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/pmorch/32/949_2.png) [@pmorch](https://forum.keycloak.org/u/pmorch)\
**Post date:** [April 21, 2021, 9:41am UTC](https://forum.keycloak.org/t/getting-invalid-grant-during-client-token-request-using-authorization-code/2042/5 "2021-04-21T09:41:55Z")

</div>

I’ve seen this too.

`/app/oauth2/loginCallback?session_state=yadayada&code=yadayada`

When we then try to use that code to get tokens from keycloak we have seen - one single time only - :

`{"error":"invalid_grant","error_description":"Code not valid"}`

We didn’t see it in test, and now in prod we’ve seen thousands of successful logins, but this error _once_.

It sounds like perhaps @arozar has a different issue if he is seeing this consistently…

If anybody has ideas…