# unsupported_grant_type

The token request named a grant type this server does not implement (RFC 6749 §5.2).

## Meaning

Sent by `/token` when `grant_type` is none of `authorization_code`, `refresh_token`,
`client_credentials` and `urn:ietf:params:oauth:grant-type:device_code`, nor one of the
two grants answered `temporarily_unavailable` (token exchange and JWT bearer). The
client authenticated first, so the refusal is filed against it.

## Impact

The client cannot get a token this way at all. It is a client bug: a typo in the grant
type, a grant from another server, or the `password` or `implicit` flow, which this
server does not offer.

## Diagnosis

1. Look at the `grant_type` the client sent: the audit record under `oauth.token.issued`
   carries it as `grant_type`, with reason `unsupported_grant_type`. Find it by
   `X-Request-ID` on the Troubleshooting page.
2. The grants this server serves are listed in `grant_types_supported` in the discovery
   document.

## Mitigation

- As a client developer: use one of the supported grants, spelled exactly; the device
  grant takes the full URN.
- As an operator: nothing to change on the server.
- As a user: tell the application's owner.

## Escalation

If a grant listed in the discovery document is answered this way, open an issue with the
request id, the server version and the grant type sent.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.