# Invalid user credentials when login by password, If turn OTP to Alternative

**URL:** <https://forum.keycloak.org/t/invalid-user-credentials-when-login-by-password-if-turn-otp-to-alternative/24237>\
**Category:** Getting advice\
**Created:** [January 26, 2024, 10:33am UTC](https://forum.keycloak.org/t/invalid-user-credentials-when-login-by-password-if-turn-otp-to-alternative/24237 "2024-01-26T10:33:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tuhuynh2013](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/tuhuynh2013/32/9621_2.png) [@tuhuynh2013](https://forum.keycloak.org/u/tuhuynh2013)\
**Post date:** [January 26, 2024, 10:33am UTC](https://forum.keycloak.org/t/invalid-user-credentials-when-login-by-password-if-turn-otp-to-alternative/24237/1 "2024-01-26T10:33:39Z")

</div>

I want to retrieve access token via api where I provide password or opt (from GG Authenticator).

How to get access token via API POST https://{mydomain}/realms/Resource/protocol/openid-connect/token by password or opt (FE will provide appropriate the param depend on user chose).

I already config the direct grant flow like below on keycloak version 23.0.4

 ![](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/1/1b60075b363554ed33cff52e37ec5472ebab4c8a.png)  
More detail, api returns 401 when I add OTP step and set it to Alternative. If I disable OTP, it returns 200  
 ![](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/8/8142aa96ff84433917aba7893a1c9b4fc7a51944.png)  
I implemented almost the same way for Browser authen flow and it worked. But Direct grant is not.

Thank you!