{"record":{"id":"3b4864833ec0f0dc","repo":"langgenius/dify","slug":"invalid-grant-type","errorCode":null,"errorMessage":"invalid grant_type","messagePattern":"invalid grant_type","errorType":"http","errorClass":"BadRequest","httpStatus":400,"severity":"error","filePath":"api/controllers/console/auth/oauth_server.py","lineNumber":204,"sourceCode":"        return jsonable_encoder(\n            {\n                \"code\": code,\n            }\n        )\n\n\n@console_ns.route(\"/oauth/provider/token\")\nclass OAuthServerUserTokenApi(Resource):\n    @setup_required\n    @console_ns.expect(console_ns.models[OAuthTokenRequest.__name__])\n    @console_ns.response(200, \"Success\", console_ns.models[OAuthProviderTokenResponse.__name__])\n    @oauth_server_client_id_required\n    @model_validate(OAuthTokenRequest)\n    def post(self, payload: OAuthTokenRequest, oauth_provider_app: OAuthProviderApp):\n        try:\n            grant_type = OAuthGrantType(payload.grant_type)\n        except ValueError:\n            raise BadRequest(\"invalid grant_type\")\n        match grant_type:\n            case OAuthGrantType.AUTHORIZATION_CODE:\n                if not payload.code:\n                    raise BadRequest(\"code is required\")\n\n                if payload.client_secret != oauth_provider_app.client_secret:\n                    raise BadRequest(\"client_secret is invalid\")\n\n                if payload.redirect_uri not in oauth_provider_app.redirect_uris:\n                    raise BadRequest(\"redirect_uri is invalid\")\n\n                access_token, refresh_token = OAuthServerService.sign_oauth_access_token(\n                    grant_type, code=payload.code, client_id=oauth_provider_app.client_id\n                )\n                return jsonable_encoder(\n                    {\n                        \"access_token\": access_token,\n                        \"token_type\": \"Bearer\",","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/oauth_server.py#L186-L222","documentation":"Flask BadRequest (HTTP 400) raised at oauth_server.py:204 in OAuthServerUserTokenApi.post (POST /console/api/oauth/provider/token) when OAuthGrantType(payload.grant_type) raises ValueError — the supplied grant_type string is not one of the enum members (e.g. not 'authorization_code' or 'refresh_token'). This is the first validation in the token endpoint.","triggerScenarios":"POST /oauth/provider/token with a grant_type the server does not recognize (typo, unsupported value like 'password' or 'client_credentials', or missing). The enum constructor raises ValueError -> caught -> BadRequest.","commonSituations":"OAuth client built for a different grant flow than this server supports; schema drift after an upgrade that renamed grant types; or a malformed test payload.","solutions":["Use only the grant_type values the server supports: 'authorization_code' to exchange a code, or 'refresh_token' to rotate tokens.","Check the OAuthGrantType enum definition for the canonical string values and match them exactly (case-sensitive).","Ensure the field is present in the JSON body — an empty/None value will also fail enum construction.","Update the client if a version change altered the accepted grant_type strings."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const ALLOWED = new Set(['authorization_code', 'refresh_token']);\nif (!ALLOWED.has(grantType)) {\n  throw new Error(`Unsupported grant_type '${grantType}'`);\n}","typeGuard":"function isSupportedGrantType(v: string): v is 'authorization_code' | 'refresh_token' {\n  return v === 'authorization_code' || v === 'refresh_token';\n}","tryCatchPattern":"try {\n  await requestToken({grant_type: grantType, ...});\n} catch (e) {\n  if (/invalid grant_type/i.test(e.message)) { correctGrantType(); } else throw e;\n}","preventionTips":["Match grant_type strings exactly (case-sensitive) to the enum.","Do not attempt unsupported flows (password, client_credentials).","Re-read the enum after library upgrades."],"tags":["oauth-server","grant-type","token","validation"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}