{"record":{"id":"f2cc41785fd8ff04","repo":"thingsboard/thingsboard","slug":"invalid-client-registration-with-id","errorCode":null,"errorMessage":"Invalid Client Registration with Id: {}","messagePattern":"Invalid Client Registration with Id: (.+?)","errorType":"http","errorClass":"IllegalArgumentException","httpStatus":500,"severity":"error","filePath":"application/src/main/java/org/thingsboard/server/config/CustomOAuth2AuthorizationRequestResolver.java","lineNumber":133,"sourceCode":"        return request.getParameter(\"pkg\");\n    }\n\n    private String getPlatform(HttpServletRequest request) {\n        return request.getParameter(\"platform\");\n    }\n\n    private String getAppToken(HttpServletRequest request) {\n        return request.getParameter(\"appToken\");\n    }\n\n    private OAuth2AuthorizationRequest resolve(HttpServletRequest request, String oauth2ClientId, String redirectUriAction, String appPackage, String platform, String appToken) {\n        if (oauth2ClientId == null) {\n            return null;\n        }\n\n        ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId(oauth2ClientId);\n        if (clientRegistration == null) {\n            throw new IllegalArgumentException(\"Invalid Client Registration with Id: \" + oauth2ClientId);\n        }\n\n        Map<String, Object> attributes = new HashMap<>();\n        attributes.put(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId());\n        if (!StringUtils.isEmpty(appPackage)) {\n            if (StringUtils.isEmpty(appToken)) {\n                throw new IllegalArgumentException(\"Invalid application token.\");\n            } else {\n                String callbackUrlScheme;\n                if (platform != null) {\n                    callbackUrlScheme = validateMobileAppToken(oauth2ClientId, appPackage, PlatformType.valueOf(platform), appToken);\n                } else {\n                    // for backward compatibility with mobile apps of version 1.3.0 and less try to validate token with android and then ios app secret\n                    try {\n                        callbackUrlScheme = validateMobileAppToken(oauth2ClientId, appPackage, PlatformType.ANDROID, appToken);\n                    } catch (IllegalArgumentException e) {\n                        log.debug(\"Failed attempt to validate android application token, oauth client id: [{}], package name: [{}], appToken [{}] \",\n                                oauth2ClientId, appPackage, appToken, e);","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/thingsboard/thingsboard/blob/45c30e83fa57356840d5f25d894002d94222d524/application/src/main/java/org/thingsboard/server/config/CustomOAuth2AuthorizationRequestResolver.java#L115-L151","documentation":"IllegalArgumentException from ThingsBoard's custom OAuth2 authorization request resolver: the oauth2ClientId request parameter does not match any ClientRegistration in the Spring client registration repository. Login link generation aborts instead of building a request for an unknown client.","triggerScenarios":"GET /oauth2/authorization/{registrationId} (or mobile app login with appToken flow) where the registration id is deleted, renamed, or from another platform instance; stale mobile apps caching an old oauth2 client UUID as registration id.","commonSituations":"OAuth2 client deleted/recreated after mobile app rollout; DNS/env switch pointing to a different ThingsBoard core; copied login URLs with outdated client ids; platform upgrade changing registration id format (name vs UUID).","solutions":["List current OAuth2 clients (UI: Security -> OAuth2, or /api/noauth/oauth2Clients) and use the current registration id.","Update the mobile app configuration / login link to the new oauth2 client id.","If clients were deleted, re-create the OAuth2 client with the original provider settings.","Clear cached login URLs or bookmarks referencing the old id."],"exampleFix":"# before\nGET /oauth2/authorization/550e8400-e29b-41d4-a716-446655440000  # deleted client\n\n# after\nGET /oauth2/authorization/<current-registration-id>","handlingStrategy":"validation","validationCode":"// before redirecting to OAuth2 login\nClientRegistration reg = clientRegistrationRepository.findByRegistrationId(id);\nif (reg == null) {\n    // fetch current clients from the platform and refresh stored ids\n    throw new IllegalStateException(\"Unknown OAuth2 client: \" + id);\n}","typeGuard":null,"tryCatchPattern":"try {\n    resolver.resolve(request);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Invalid Client Registration\")) {\n        // re-fetch client list, update stored registration id, retry login\n    } else { throw e; }\n}","preventionTips":["Mobile apps should refetch OAuth2 client ids at startup, not cache forever.","Keep client registration ids stable when re-creating clients.","Log the requested id when login failures spike."],"tags":["java","oauth2","authentication","mobile"],"backgroundTag":null,"analyzedSha":"45c30e83fa57356840d5f25d894002d94222d524","analyzedAt":"2026-08-14T11:45:36.599Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}