OrchardCMS/OrchardCore · error · NotSupportedException

The specified grant type is not supported.

Error message

The specified grant type is not supported.

What it means

AccessController.Token dispatches token requests by grant type: authorization_code and refresh_token go to ExchangeAuthorizationCodeOrRefreshTokenGrantType, while other supported grants (password, client_credentials) are handled by the OpenIddict events/dispatching before it. If the request's grant_type is none of the supported ones, Token throws NotSupportedException('The specified grant type is not supported.').

Solutions

1. Change the client to use a supported grant_type: authorization_code, refresh_token, password, or client_credentials.
2. Fix a misspelled grant_type value in the token request.
3. If you need another grant (e.g. device code), enable the corresponding OpenIddict flow in the tenant's OpenID settings and add handling code; otherwise avoid it.
4. Check for custom OpenIddict server event handlers that may have swallowed the request without responding.

Example fix

// before
grant_type: "urn:ietf:params:oauth:grant-type:device_code"
// after
grant_type: "client_credentials"

string[] supported = ["authorization_code", "refresh_token", "password", "client_credentials"];
if (!supported.Contains(request.GrantType))
    throw new InvalidOperationException($"grant_type '{request.GrantType}' is not supported.");

bool IsSupportedGrant(string grantType) => grantType is
    "authorization_code" or "refresh_token" or "password" or "client_credentials";

try
{
    return await TokenClient.RequestTokenAsync(grantType: grantType);
}
catch (NotSupportedException ex)
{
    logger.LogError(ex, "Unsupported grant_type {Grant}", grantType);
    throw new ArgumentException("Use a supported grant_type.", nameof(grantType), ex);
}

When it happens

Trigger: POST to the token endpoint with a grant_type other than authorization_code, refresh_token, password, or client_credentials — e.g. 'urn:ietf:params:oauth:grant-type:device_code', 'client_jwt', or an empty/misspelled grant_type — and no OpenIddict event handler handled it.

Common situations: Client library defaults to an extended grant the server does not enable; grant_type header mis-typed; custom code calling the token endpoint for an unsupported flow; OpenIddict grant handlers disabled in settings.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• The application details cannot be found.
• The user principal cannot be resolved.
• The type ' ' is not support by Azure AI Search
• The application was concurrently updated and cannot be…
• The authorization was concurrently updated and cannot be…

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/8a833142e4c26943. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.OpenId/Controllers/AccessController.cs:459

            return Task.FromResult((IActionResult)NotFound());
        }

        if (request.IsPasswordGrantType())
        {
            return ExchangePasswordGrantType(request);
        }

        if (request.IsClientCredentialsGrantType())
        {
            return ExchangeClientCredentialsGrantType(request);
        }

        if (request.IsAuthorizationCodeGrantType() || request.IsRefreshTokenGrantType())
        {
            return ExchangeAuthorizationCodeOrRefreshTokenGrantType(request);
        }

        throw new NotSupportedException("The specified grant type is not supported.");
    }

    private async Task<IActionResult> ExchangeClientCredentialsGrantType(OpenIddictRequest request)
    {
        if (request.HasScope(Scopes.OfflineAccess))
        {
            return Forbid(new AuthenticationProperties(new Dictionary<string, string>
            {
                [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidScope,
                [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
                    "The 'offline_access' scope is not allowed when using the client credentials grant.",
            }), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
        }

        // Note: client authentication is always enforced by OpenIddict before this action is invoked.
        var application = await _applicationManager.FindByClientIdAsync(request.ClientId) ??
            throw new InvalidOperationException("The application details cannot be found.");

View on GitHub (pinned to 4306c0717f)