{"record":{"id":"3170dd5ee002155e","repo":"apereo/cas","slug":"client-credentials-provided-is-not-valid-for-regis","errorCode":null,"errorMessage":"Client Credentials provided is not valid for registered service: ","messagePattern":"Client Credentials provided is not valid for registered service: ","errorType":"exception","errorClass":"CredentialsException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java","lineNumber":81,"sourceCode":"    private final ConfigurableApplicationContext applicationContext;\n\n    @Override\n    public Optional<Credentials> validate(final CallContext callContext, final Credentials credentials) throws CredentialsException {\n        try {\n            val upc = (UsernamePasswordCredentials) credentials;\n            val casCredential = new UsernamePasswordCredential(upc.getUsername(), upc.getPassword());\n            val clientIdAndSecret = requestParameterResolver.resolveClientIdAndClientSecret(callContext);\n            if (StringUtils.isBlank(clientIdAndSecret.getKey())) {\n                throw new CredentialsException(\"No client credentials could be identified in this request\");\n            }\n\n            val clientId = clientIdAndSecret.getKey();\n            val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(servicesManager, clientId);\n            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);\n\n            val clientSecret = clientIdAndSecret.getRight();\n            if (!clientSecretValidator.validate(registeredService, clientSecret)) {\n                throw new CredentialsException(\"Client Credentials provided is not valid for registered service: \"\n                    + Objects.requireNonNull(registeredService).getName());\n            }\n            val redirectUri = requestParameterResolver.resolveRequestParameter(callContext.webContext(), OAuth20Constants.REDIRECT_URI)\n                .map(String::valueOf).orElse(StringUtils.EMPTY);\n            OAuth20Utils.validateRedirectUri(redirectUri, true);\n            val service = StringUtils.isNotBlank(redirectUri)\n                ? webApplicationServiceFactory.createService(redirectUri)\n                : webApplicationServiceFactory.createService(clientId);\n            service.getAttributes().put(OAuth20Constants.CLIENT_ID, CollectionUtils.wrapList(clientId));\n            service.getAttributes().put(OAuth20Constants.REDIRECT_URI, CollectionUtils.wrapList(redirectUri));\n\n            val authenticationResult = authenticationSystemSupport.finalizeAuthenticationTransaction(service, casCredential);\n            if (authenticationResult == null) {\n                throw new CredentialsException(\"Could not authenticate the provided credentials\");\n            }\n\n            val principal = buildAuthenticatedPrincipal(authenticationResult, registeredService, service, callContext);\n            val profile = new CommonProfile();","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java#L63-L99","documentation":"Thrown when the extracted client_secret fails the registered service's secret validation. The client_id resolved to a registered OAuth service (and access was allowed), but the provided secret does not match the configured one, so the credentials are rejected.","triggerScenarios":"Request carries a client_id that resolves to a registered service but the accompanying client_secret (form param or basic auth) is wrong, stale after rotation, or compared against a service whose secret was recently changed in the service registry.","commonSituations":"Environment mismatch (staging secret used against production); secrets rotated in the service registry JSON/YAML but not in the client; whitespace/encoding issues in the secret; client configured with the end-user password instead of the client secret.","solutions":["Verify the client_secret sent matches the secret configured on the registered OAuth service and redeploy/reload the service registry if it changed","Re-send credentials via HTTP Basic auth (base64(client_id:client_secret)) ensuring correct encoding without stray whitespace","Check the registered service's name in the error against the service you think you are calling — the client_id may resolve to a different registered service than expected","If secrets are encrypted, confirm the encryption key/secret configuration used by the service registry matches what was used when storing"],"exampleFix":"// before\nAuthorization: Basic base64(\"myclient:userpassword\")\n// after\nAuthorization: Basic base64(\"myclient:configuredClientSecret\")","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await casLogin({ clientId, clientSecret });\n} catch (e) {\n  if (String(e.message).startsWith('Client Credentials provided is not valid')) {\n    // reload secret from secret store / alert on rotation mismatch\n  }\n}","preventionTips":["Keep client secrets in sync between the CAS service registry and clients","Use Basic auth with correct base64(client_id:client_secret) encoding","Re-check secrets after any registry rotation or redeploy"],"tags":["oauth2","client-secret","authentication"],"backgroundTag":"invalid-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}