{"record":{"id":"b7d6fde88a08419d","repo":"spring-projects/spring-security","slug":"invalid-authorization-grant-type-granttype-fo","errorCode":null,"errorMessage":"Invalid Authorization Grant Type (${grantType}) for Client Registration with Id: ${registrationId}","messagePattern":"Invalid Authorization Grant Type \\((.+?)\\) for Client Registration with Id: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java","lineNumber":212,"sourceCode":"\t\t\tOAuth2AuthorizationRequest.Builder builder = OAuth2AuthorizationRequest.authorizationCode()\n\t\t\t\t\t.attributes((attrs) ->\n\t\t\t\t\t\t\tattrs.put(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId()));\n\t\t\t// @formatter:on\n\t\t\tif (!CollectionUtils.isEmpty(clientRegistration.getScopes())\n\t\t\t\t\t&& clientRegistration.getScopes().contains(OidcScopes.OPENID)) {\n\t\t\t\t// Section 3.1.2.1 Authentication Request -\n\t\t\t\t// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest scope\n\t\t\t\t// REQUIRED. OpenID Connect requests MUST contain the \"openid\" scope\n\t\t\t\t// value.\n\t\t\t\tapplyNonce(builder);\n\t\t\t}\n\t\t\tif (ClientAuthenticationMethod.NONE.equals(clientRegistration.getClientAuthenticationMethod())\n\t\t\t\t\t|| clientRegistration.getClientSettings().isRequireProofKey()) {\n\t\t\t\tDEFAULT_PKCE_APPLIER.accept(builder);\n\t\t\t}\n\t\t\treturn builder;\n\t\t}\n\t\tthrow new IllegalArgumentException(\n\t\t\t\t\"Invalid Authorization Grant Type (\" + clientRegistration.getAuthorizationGrantType().getValue()\n\t\t\t\t\t\t+ \") for Client Registration with Id: \" + clientRegistration.getRegistrationId());\n\t}\n\n\tprivate @Nullable String resolveRegistrationId(HttpServletRequest request) {\n\t\tif (this.authorizationRequestMatcher.matches(request)) {\n\t\t\treturn this.authorizationRequestMatcher.matcher(request)\n\t\t\t\t.getVariables()\n\t\t\t\t.get(REGISTRATION_ID_URI_VARIABLE_NAME);\n\t\t}\n\t\treturn null;\n\t}\n\n\t/**\n\t * Expands the {@link ClientRegistration#getRedirectUri()} with following provided\n\t * variables:<br/>\n\t * - baseUrl (e.g. https://localhost/app) <br/>\n\t * - baseScheme (e.g. https) <br/>","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java#L194-L230","documentation":"Spring Security's OAuth2 client only supports authorization_code (and client-side PKCE variants) when building an authorization request. DefaultOAuth2AuthorizationRequestResolver.getBuilder throws this IllegalArgumentException when the ClientRegistration's AuthorizationGrantType is neither AuthorizationGrantType.AUTHORIZATION_CODE nor JWT_BEARER, i.e. the resolver was asked to build an authorization redirect for a grant type that has no browser redirect flow.","triggerScenarios":"A ClientRegistration is registered with an unsupported grant type (e.g. AuthorizationGrantType.CLIENT_CREDENTIALS or a custom 'password'/'urn:...:jwt-bearer' value) and the user hits the /oauth2/authorization/{registrationId} endpoint or OAuth2LoginAuthenticationFilter resolves that registration.","commonSituations":"Developers copy a client_credentials service-to-service registration into spring.security.oauth2.client.registration and then visit the login URL; older configs using custom grant-type strings after Spring Security 5.4 tightened validation; mixing a resource-server-only client into the login flow.","solutions":["Change the registration's grant type to authorization_code (or omit grant-type in YAML so it defaults to authorization_code)","Remove that registration from the OAuth2 login/client-registration flow and obtain tokens for it directly with OAuth2AuthorizedClientProvider (e.g. client_credentials) instead of a browser redirect","If you truly need another grant type, implement a custom OAuth2AuthorizationRequestResolver instead of relying on the default"],"exampleFix":"// before\nspring.security.oauth2.client.registration.myclient.authorization-grant-type: client_credentials\n// after\nspring.security.oauth2.client.registration.myclient.authorization-grant-type: authorization_code","handlingStrategy":"validation","validationCode":"if (!AuthorizationGrantType.AUTHORIZATION_CODE.equals(registration.getAuthorizationGrantType())) {\n    throw new IllegalStateException(\"Registration \" + registration.getRegistrationId() + \" cannot be used with OAuth2 login\");\n}","typeGuard":"boolean isLoginCapable(ClientRegistration r) {\n    return AuthorizationGrantType.AUTHORIZATION_CODE.equals(r.getAuthorizationGrantType());\n}","tryCatchPattern":null,"preventionTips":["Default to authorization_code grant type for browser login registrations","Keep client_credentials registrations out of the login flow; fetch tokens programmatically","Review registration YAML/bean definitions after upgrading Spring Security versions"],"tags":["oauth2","spring-security","configuration","grant-type"],"backgroundTag":"invalid-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}