{"record":{"id":"3cb8de3516889af9","repo":"Significant-Gravitas/AutoGPT","slug":"unsupported-grant-type-request-grant-type-must","errorCode":null,"errorMessage":"Unsupported grant_type: {request.grant_type}. Must be 'authorization_code' or 'refresh_token'","messagePattern":"Unsupported grant_type: (.+?)\\. Must be 'authorization_code' or 'refresh_token'","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/oauth.py","lineNumber":445,"sourceCode":"        )\n\n        if not new_access_token.token or not new_refresh_token.token:\n            raise HTTPException(\n                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                detail=\"Failed to generate tokens\",\n            )\n\n        return TokenResponse(\n            token_type=\"Bearer\",\n            access_token=new_access_token.token.get_secret_value(),\n            access_token_expires_at=new_access_token.expires_at,\n            refresh_token=new_refresh_token.token.get_secret_value(),\n            refresh_token_expires_at=new_refresh_token.expires_at,\n            scopes=list(s.value for s in new_access_token.scopes),\n        )\n\n    else:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=f\"Unsupported grant_type: {request.grant_type}. \"\n            \"Must be 'authorization_code' or 'refresh_token'\",\n        )\n\n\n# ============================================================================\n# Token Introspection Endpoint\n# ============================================================================\n\n\n@router.post(\"/introspect\")\nasync def introspect(\n    token: str = Body(description=\"Token to introspect\"),\n    token_type_hint: Optional[Literal[\"access_token\", \"refresh_token\"]] = Body(\n        None, description=\"Hint about token type ('access_token' or 'refresh_token')\"\n    ),\n    client_id: str = Body(description=\"Client identifier\"),","sourceCodeStart":427,"sourceCodeEnd":463,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/oauth.py#L427-L463","documentation":"Thrown by the OAuth 2.0 token endpoint when the grant_type in the token request body is neither 'authorization_code' nor 'refresh_token'. The server only implements those two grant types, so anything else (e.g. 'client_credentials', 'password', or a typo) is rejected with HTTP 400 before any token logic runs.","triggerScenarios":"POSTing to the OAuth token endpoint with grant_type=client_credentials, grant_type=password, a misspelled value like 'authorizationCode', or omitting/URL-encoding the grant_type field incorrectly so FastAPI sees an unexpected string.","commonSituations":"Integrators assuming the platform supports the full OAuth2 grant set; copying example requests from another provider; form-encoding bugs that mangle the grant_type value; custom clients written before checking the API's supported grants.","solutions":["Set grant_type to exactly 'authorization_code' (with code + redirect_uri) or 'refresh_token' (with refresh_token) in the token request","Verify the request is sent as application/x-www-form-urlencoded with correctly encoded fields","Check the API docs/openapi.json for the token endpoint's accepted grant types before implementing a new flow"],"exampleFix":"# before\nrequests.post(token_url, data={\"grant_type\": \"client_credentials\", \"client_id\": cid, \"client_secret\": sec})\n# after\nrequests.post(token_url, data={\"grant_type\": \"authorization_code\", \"code\": code, \"redirect_uri\": redirect, \"client_id\": cid, \"client_secret\": sec})","handlingStrategy":"validation","validationCode":"ALLOWED_GRANTS = {\"authorization_code\", \"refresh_token\"}\nassert grant_type in ALLOWED_GRANTS, f\"unsupported grant_type: {grant_type!r}\"","typeGuard":"def is_supported_grant(g: str) -> bool:\n    return g in {\"authorization_code\", \"refresh_token\"}","tryCatchPattern":"resp = requests.post(token_url, data=payload)\nif resp.status_code == 400 and \"Unsupported grant_type\" in resp.text:\n    raise ValueError(f\"Fix grant_type: {payload.get('grant_type')}\")","preventionTips":["Read the API's token endpoint docs before implementing a new grant flow","Centralize grant_type constants instead of inline strings","Add an integration test that exercises both supported grants"],"tags":["oauth","http-400","validation","api"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}