# unauthorized_client

The client is not permitted the grant it asked for (RFC 6749 §4.1.2.1, §5.2).

## Meaning

The client's registration does not include the grant type it used: `authorization_code`,
or `implicit` for an `id_token` response type, at `/authorize` (redirected to the
client) or `/par`; `refresh_token`,
`client_credentials` or the device code grant at `/token`; the device code grant at
`/device_authorization`. A public client asking for `client_credentials` gets it whatever
its grant list says, since it has no credential to authenticate with.

## Impact

Every request of that grant from the client fails until the registration changes. It is
a misconfiguration, never normal flow. For a user at `/authorize` the error goes back to
the application before any sign-in screen.

## Diagnosis

1. The audit record carries outcome `denied`, reason `unauthorized_client` and cause
   `grant_not_allowed` or `confidential_client_required`, under
   `oauth.authorization.requested`, `oauth.token.issued` or `oauth.device.requested`.
   Find it by `X-Request-ID` on the Troubleshooting page.
2. Compare the grant used with the client's grant types (dashboard client page, or
   `spec.grantTypes` on its `OIDCClient`).

## Mitigation

- As a client developer: use a grant the client is registered for, or ask for the
  registration to be changed. Machine-to-machine access needs a confidential client.
- As an operator: add the grant to the client's registration, or register a separate
  client for it. A dynamically registered client can only hold `authorization_code` and
  `refresh_token`.
- As a user: tell the application's owner.

## Escalation

If the registration lists the grant and the request is still refused, open an issue with
the request id, the server version and the client's registered grant types. Never attach
secrets or tokens.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.