{"record":{"id":"8a833142e4c26943","repo":"OrchardCMS/OrchardCore","slug":"the-specified-grant-type-is-not-supported","errorCode":null,"errorMessage":"The specified grant type is not supported.","messagePattern":"The specified grant type is not supported\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.OpenId/Controllers/AccessController.cs","lineNumber":459,"sourceCode":"            return Task.FromResult((IActionResult)NotFound());\n        }\n\n        if (request.IsPasswordGrantType())\n        {\n            return ExchangePasswordGrantType(request);\n        }\n\n        if (request.IsClientCredentialsGrantType())\n        {\n            return ExchangeClientCredentialsGrantType(request);\n        }\n\n        if (request.IsAuthorizationCodeGrantType() || request.IsRefreshTokenGrantType())\n        {\n            return ExchangeAuthorizationCodeOrRefreshTokenGrantType(request);\n        }\n\n        throw new NotSupportedException(\"The specified grant type is not supported.\");\n    }\n\n    private async Task<IActionResult> ExchangeClientCredentialsGrantType(OpenIddictRequest request)\n    {\n        if (request.HasScope(Scopes.OfflineAccess))\n        {\n            return Forbid(new AuthenticationProperties(new Dictionary<string, string>\n            {\n                [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidScope,\n                [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =\n                    \"The 'offline_access' scope is not allowed when using the client credentials grant.\",\n            }), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);\n        }\n\n        // Note: client authentication is always enforced by OpenIddict before this action is invoked.\n        var application = await _applicationManager.FindByClientIdAsync(request.ClientId) ??\n            throw new InvalidOperationException(\"The application details cannot be found.\");\n","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.OpenId/Controllers/AccessController.cs#L441-L477","documentation":"AccessController.Token dispatches token requests by grant type: authorization_code and refresh_token go to ExchangeAuthorizationCodeOrRefreshTokenGrantType, while other supported grants (password, client_credentials) are handled by the OpenIddict events/dispatching before it. If the request's grant_type is none of the supported ones, Token throws NotSupportedException('The specified grant type is not supported.').","triggerScenarios":"POST to the token endpoint with a grant_type other than authorization_code, refresh_token, password, or client_credentials — e.g. 'urn:ietf:params:oauth:grant-type:device_code', 'client_jwt', or an empty/misspelled grant_type — and no OpenIddict event handler handled it.","commonSituations":"Client library defaults to an extended grant the server does not enable; grant_type header mis-typed; custom code calling the token endpoint for an unsupported flow; OpenIddict grant handlers disabled in settings.","solutions":["Change the client to use a supported grant_type: authorization_code, refresh_token, password, or client_credentials.","Fix a misspelled grant_type value in the token request.","If you need another grant (e.g. device code), enable the corresponding OpenIddict flow in the tenant's OpenID settings and add handling code; otherwise avoid it.","Check for custom OpenIddict server event handlers that may have swallowed the request without responding."],"exampleFix":"// before\ngrant_type: \"urn:ietf:params:oauth:grant-type:device_code\"\n// after\ngrant_type: \"client_credentials\"","handlingStrategy":"validation","validationCode":"string[] supported = [\"authorization_code\", \"refresh_token\", \"password\", \"client_credentials\"];\nif (!supported.Contains(request.GrantType))\n    throw new InvalidOperationException($\"grant_type '{request.GrantType}' is not supported.\");","typeGuard":"bool IsSupportedGrant(string grantType) => grantType is\n    \"authorization_code\" or \"refresh_token\" or \"password\" or \"client_credentials\";","tryCatchPattern":"try\n{\n    return await TokenClient.RequestTokenAsync(grantType: grantType);\n}\ncatch (NotSupportedException ex)\n{\n    logger.LogError(ex, \"Unsupported grant_type {Grant}\", grantType);\n    throw new ArgumentException(\"Use a supported grant_type.\", nameof(grantType), ex);\n}","preventionTips":["Only request grants the server has explicitly enabled.","Copy grant_type strings from documentation verbatim; they are case-sensitive URNs.","Pin client library defaults to supported flows."],"tags":["openid","oauth","grant-type","unsupported"],"backgroundTag":"unsupported-operation","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}