{"record":{"id":"4f2b300d0a5013e5","repo":"quarkusio/quarkus","slug":"s-oidcclient-wants-to-use-jwt-bearer-grant-assert","errorCode":null,"errorMessage":"%s OidcClient wants to use JWT bearer grant assertion but has a wrong grant type %s configured. You must set 'quarkus.oidc-client.grant.type' property to 'jwt'.","messagePattern":"(.+?) OidcClient wants to use JWT bearer grant assertion but has a wrong grant type (.+?) configured\\. You must set 'quarkus\\.oidc-client\\.grant\\.type' property to 'jwt'\\.","errorType":"exception","errorClass":"OidcClientException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java","lineNumber":250,"sourceCode":"            body.set(OidcConstants.CLIENT_ASSERTION_TYPE,\n                    clientAssertionProvider != null ? clientAssertionProvider.getClientAssertionType()\n                            : OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);\n        } else if (clientJwtKey != null) {\n            // if it is a refresh then a map has already been copied\n            body = !isRefresh(op) ? copyMultiMap(body) : body;\n            String jwt = OidcCommonUtils.signJwtWithKey(oidcConfig, tokenRequestUri, clientJwtKey);\n\n            if (OidcCommonUtils.isClientSecretPostJwtAuthRequired(oidcConfig.credentials())) {\n                body.add(OidcConstants.CLIENT_ID, oidcConfig.clientId().get());\n                body.add(OidcConstants.CLIENT_SECRET, jwt);\n            } else if (OidcCommonUtils.isJwtAssertion(oidcConfig.credentials())) {\n                if (!OidcConstants.JWT_BEARER_GRANT_TYPE.equals(body.get(OidcConstants.GRANT_TYPE))) {\n                    String errorMessage = String.format(\n                            \"%s OidcClient wants to use JWT bearer grant assertion but has a wrong grant type %s configured.\"\n                                    + \" You must set 'quarkus.oidc-client.grant.type' property to 'jwt'.\",\n                            oidcConfig.id().get(), body.get(OidcConstants.GRANT_TYPE));\n                    LOG.error(errorMessage);\n                    throw new OidcClientException(errorMessage);\n                }\n                body.add(OidcConstants.JWT_BEARER_GRANT_ASSERTION, jwt);\n            } else {\n                body.add(OidcConstants.CLIENT_ASSERTION_TYPE, OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);\n                body.add(OidcConstants.CLIENT_ASSERTION, jwt);\n            }\n        } else if (OidcCommonUtils.isClientSecretPostAuthRequired(oidcConfig.credentials())) {\n            body = !isRefresh(op) ? copyMultiMap(body) : body;\n            body.set(OidcConstants.CLIENT_ID, oidcConfig.clientId().get());\n            body.set(OidcConstants.CLIENT_SECRET, clientSecret);\n            if (hasClientSecretProvider()) {\n                credentialsToRetry = PreparedPostRequest.CredentialsToRetry.CLIENT_SECRET;\n            }\n        } else {\n            body = !isRefresh(op) ? copyMultiMap(body) : body;\n            body = copyMultiMap(body).set(OidcConstants.CLIENT_ID, oidcConfig.clientId().get());\n        }\n        if (!additionalGrantParameters.isEmpty()) {","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java#L232-L268","documentation":"OidcClientImpl.preparePostRequest throws this when the client is set up to use a JWT bearer grant assertion but the configured grant type is not 'jwt'. The JWT bearer grant requires quarkus.oidc-client.grant.type=jwt so the assertion goes into the grant itself; with any other grant type the token request would be invalid.","triggerScenarios":"quarkus.oidc-client.grant.type is set to something other than 'jwt' (e.g. client or password) while the client is also configured to produce/use a JWT bearer grant assertion (credentials.jwt with grant assertion usage), then getTokens() is called.","commonSituations":"Copy-pasting client config from a client-credentials example and adding jwt assertion settings; accidentally leaving grant.type at 'client' default while intending a jwt bearer grant; upgrading and changing grant types without updating assertion config.","solutions":["Set quarkus.oidc-client.grant.type=jwt","If a different grant (e.g. client_credentials) is intended, remove the JWT bearer grant assertion configuration","Check for named-client configs (quarkus.oidc-client.<name>.grant.type) overriding the intended value"],"exampleFix":"# before\nquarkus.oidc-client.grant.type=client\nquarkus.oidc-client.credentials.jwt.source=token\n\n# after\nquarkus.oidc-client.grant.type=jwt\nquarkus.oidc-client.credentials.jwt.source=token","handlingStrategy":"validation","validationCode":"if (usesJwtBearerAssertion && !\"jwt\".equals(config.grant().type())) {\n    throw new IllegalArgumentException(\"grant.type must be 'jwt' when JWT bearer grant assertion is configured\");\n}","typeGuard":"boolean isJwtGrant(OidcClientConfig c) {\n    return OidcConfig.Grant.JWT.equals(c.grant().type());\n}","tryCatchPattern":"try { return client.getTokens().await().indefinitely(); } catch (OidcClientException e) { if (e.getMessage().contains(\"wrong grant type\")) { throw new ConfigurationException(\"Set quarkus.oidc-client.grant.type=jwt\", e); } throw e; }","preventionTips":["Keep grant.type and credentials.jwt settings consistent","Review named-client configs for overrides","Test token acquisition in dev mode before deploying"],"tags":["oidc","config","grant-type","jwt"],"backgroundTag":"wrong-grant-type-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}