# Grant type password fails if client consent is required

**URL:** <https://forum.keycloak.org/t/grant-type-password-fails-if-client-consent-is-required/24805>\
**Category:** Getting advice\
**Created:** [February 29, 2024, 11:14am UTC](https://forum.keycloak.org/t/grant-type-password-fails-if-client-consent-is-required/24805 "2024-02-29T11:14:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kermakovich](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kermakovich/32/9189_2.png) [@kermakovich](https://forum.keycloak.org/u/kermakovich)\
**Post date:** [February 29, 2024, 11:14am UTC](https://forum.keycloak.org/t/grant-type-password-fails-if-client-consent-is-required/24805/1 "2024-02-29T11:14:31Z")

</div>

I created a client in Keycloak and chose `consent is required` toggle.  
I successfully logged in into this client using browser, accepted consent.  
Now I’m trying to retrieve token using api - `http://{host}/realms/{realm}/protocol/openid-connect/token` and `grant_type` password. But I received bad request response:

```auto
{
    "error": "invalid_client",
    "error_description": "Client requires user consent"
}

```

Is it expected? We can’t use `grant_type` password for clients with consent? I can’t find any info about this

---

<div class="post-metadata">

**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\
**Post date:** [February 29, 2024, 1:18pm UTC](https://forum.keycloak.org/t/grant-type-password-fails-if-client-consent-is-required/24805/2 "2024-02-29T13:18:50Z")

</div>

In the `ROPC` flow, there should not be a consent step because there is no interaction with the user (it’s just a login through an API call). Nevertheless, I don’t recommend using `ROPC` for a ton of reasons (security, limitations in UX experience, deprecation advice in OAuth 2.1, etc.).

---

<div class="post-metadata">

**Author:** ![kermakovich](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kermakovich/32/9189_2.png) [@kermakovich](https://forum.keycloak.org/u/kermakovich)\
**Post date:** [February 29, 2024, 1:36pm UTC](https://forum.keycloak.org/t/grant-type-password-fails-if-client-consent-is-required/24805/3 "2024-02-29T13:36:30Z")

</div>

Yes, I see, thanks for the reply. Just to clarify, Keycloak has the next code in `ROPC` flow, which is confusing:

```auto
 if (client.isConsentRequired()) {
            event.error(Errors.CONSENT_DENIED);
            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires user consent", Response.Status.BAD_REQUEST);
        }

```

So even if the user has consent, it will be an error just because of client configuration

---

<div class="post-metadata">

**Author:** ![CyborTronik](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/cybortronik/32/11274_2.png) [@CyborTronik](https://forum.keycloak.org/u/CyborTronik)\
**Post date:** [September 18, 2024, 6:15pm UTC](https://forum.keycloak.org/t/grant-type-password-fails-if-client-consent-is-required/24805/4 "2024-09-18T18:15:33Z")

</div>

@embesozzi any updates on this?