spring-projects/spring-security · error · IllegalArgumentException

Invalid Authorization Grant Type (${grantType}) for Client R

Error message

Invalid Authorization Grant Type (${grantType}) for Client Registration with Id: ${registrationId}

What it means

Spring Security's OAuth2 client only supports authorization_code (and client-side PKCE variants) when building an authorization request. DefaultOAuth2AuthorizationRequestResolver.getBuilder throws this IllegalArgumentException when the ClientRegistration's AuthorizationGrantType is neither AuthorizationGrantType.AUTHORIZATION_CODE nor JWT_BEARER, i.e. the resolver was asked to build an authorization redirect for a grant type that has no browser redirect flow.

Source

Thrown at oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java:212

			OAuth2AuthorizationRequest.Builder builder = OAuth2AuthorizationRequest.authorizationCode()
					.attributes((attrs) ->
							attrs.put(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId()));
			// @formatter:on
			if (!CollectionUtils.isEmpty(clientRegistration.getScopes())
					&& clientRegistration.getScopes().contains(OidcScopes.OPENID)) {
				// Section 3.1.2.1 Authentication Request -
				// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest scope
				// REQUIRED. OpenID Connect requests MUST contain the "openid" scope
				// value.
				applyNonce(builder);
			}
			if (ClientAuthenticationMethod.NONE.equals(clientRegistration.getClientAuthenticationMethod())
					|| clientRegistration.getClientSettings().isRequireProofKey()) {
				DEFAULT_PKCE_APPLIER.accept(builder);
			}
			return builder;
		}
		throw new IllegalArgumentException(
				"Invalid Authorization Grant Type (" + clientRegistration.getAuthorizationGrantType().getValue()
						+ ") for Client Registration with Id: " + clientRegistration.getRegistrationId());
	}

	private @Nullable String resolveRegistrationId(HttpServletRequest request) {
		if (this.authorizationRequestMatcher.matches(request)) {
			return this.authorizationRequestMatcher.matcher(request)
				.getVariables()
				.get(REGISTRATION_ID_URI_VARIABLE_NAME);
		}
		return null;
	}

	/**
	 * Expands the {@link ClientRegistration#getRedirectUri()} with following provided
	 * variables:<br/>
	 * - baseUrl (e.g. https://localhost/app) <br/>
	 * - baseScheme (e.g. https) <br/>

View on GitHub (pinned to 96852e8860)

Solutions

1. Change the registration's grant type to authorization_code (or omit grant-type in YAML so it defaults to authorization_code)
2. Remove that registration from the OAuth2 login/client-registration flow and obtain tokens for it directly with OAuth2AuthorizedClientProvider (e.g. client_credentials) instead of a browser redirect
3. If you truly need another grant type, implement a custom OAuth2AuthorizationRequestResolver instead of relying on the default

Example fix

// before
spring.security.oauth2.client.registration.myclient.authorization-grant-type: client_credentials
// after
spring.security.oauth2.client.registration.myclient.authorization-grant-type: authorization_code

if (!AuthorizationGrantType.AUTHORIZATION_CODE.equals(registration.getAuthorizationGrantType())) {
    throw new IllegalStateException("Registration " + registration.getRegistrationId() + " cannot be used with OAuth2 login");
}

boolean isLoginCapable(ClientRegistration r) {
    return AuthorizationGrantType.AUTHORIZATION_CODE.equals(r.getAuthorizationGrantType());
}

When it happens

Trigger: A ClientRegistration is registered with an unsupported grant type (e.g. AuthorizationGrantType.CLIENT_CREDENTIALS or a custom 'password'/'urn:...:jwt-bearer' value) and the user hits the /oauth2/authorization/{registrationId} endpoint or OAuth2LoginAuthenticationFilter resolves that registration.

Common situations: Developers copy a client_credentials service-to-service registration into spring.security.oauth2.client.registration and then visit the login URL; older configs using custom grant-type strings after Spring Security 5.4 tightened validation; mixing a resource-server-only client into the login flow.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• No enum constant org.springframework.security.oauth2.client.
• missing_user_info_uri
• missing_user_name_attribute
• missing_user_info_uri
• missing_user_name_attribute

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b7d6fde88a08419d. Report an issue: GitHub.