thingsboard/thingsboard · error · IllegalArgumentException

Invalid Client Registration with Id: {}

Error message

Invalid Client Registration with Id: {}

What it means

IllegalArgumentException from ThingsBoard's custom OAuth2 authorization request resolver: the oauth2ClientId request parameter does not match any ClientRegistration in the Spring client registration repository. Login link generation aborts instead of building a request for an unknown client.

Source

Thrown at application/src/main/java/org/thingsboard/server/config/CustomOAuth2AuthorizationRequestResolver.java:133

        return request.getParameter("pkg");
    }

    private String getPlatform(HttpServletRequest request) {
        return request.getParameter("platform");
    }

    private String getAppToken(HttpServletRequest request) {
        return request.getParameter("appToken");
    }

    private OAuth2AuthorizationRequest resolve(HttpServletRequest request, String oauth2ClientId, String redirectUriAction, String appPackage, String platform, String appToken) {
        if (oauth2ClientId == null) {
            return null;
        }

        ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId(oauth2ClientId);
        if (clientRegistration == null) {
            throw new IllegalArgumentException("Invalid Client Registration with Id: " + oauth2ClientId);
        }

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId());
        if (!StringUtils.isEmpty(appPackage)) {
            if (StringUtils.isEmpty(appToken)) {
                throw new IllegalArgumentException("Invalid application token.");
            } else {
                String callbackUrlScheme;
                if (platform != null) {
                    callbackUrlScheme = validateMobileAppToken(oauth2ClientId, appPackage, PlatformType.valueOf(platform), appToken);
                } else {
                    // for backward compatibility with mobile apps of version 1.3.0 and less try to validate token with android and then ios app secret
                    try {
                        callbackUrlScheme = validateMobileAppToken(oauth2ClientId, appPackage, PlatformType.ANDROID, appToken);
                    } catch (IllegalArgumentException e) {
                        log.debug("Failed attempt to validate android application token, oauth client id: [{}], package name: [{}], appToken [{}] ",
                                oauth2ClientId, appPackage, appToken, e);

View on GitHub (pinned to 45c30e83fa)

Solutions

1. List current OAuth2 clients (UI: Security -> OAuth2, or /api/noauth/oauth2Clients) and use the current registration id.
2. Update the mobile app configuration / login link to the new oauth2 client id.
3. If clients were deleted, re-create the OAuth2 client with the original provider settings.
4. Clear cached login URLs or bookmarks referencing the old id.

Example fix

# before
GET /oauth2/authorization/550e8400-e29b-41d4-a716-446655440000  # deleted client

# after
GET /oauth2/authorization/<current-registration-id>

// before redirecting to OAuth2 login
ClientRegistration reg = clientRegistrationRepository.findByRegistrationId(id);
if (reg == null) {
    // fetch current clients from the platform and refresh stored ids
    throw new IllegalStateException("Unknown OAuth2 client: " + id);
}

try {
    resolver.resolve(request);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Invalid Client Registration")) {
        // re-fetch client list, update stored registration id, retry login
    } else { throw e; }
}

When it happens

Trigger: GET /oauth2/authorization/{registrationId} (or mobile app login with appToken flow) where the registration id is deleted, renamed, or from another platform instance; stale mobile apps caching an old oauth2 client UUID as registration id.

Common situations: OAuth2 client deleted/recreated after mobile app rollout; DNS/env switch pointing to a different ThingsBoard core; copied login URLs with outdated client ids; platform upgrade changing registration id format (name vs UUID).

Related errors

• Invalid application token.
• Invalid Authorization Grant Type ({}) for Client Registratio
• Invalid package: {}. No application secret found for Client
• GENERAL
• TBEL execution is disabled!

AI-assisted analysis of thingsboard/thingsboard@45c30e83fa (2026-08-14). Data as JSON: /api/errors/f2cc41785fd8ff04. Report an issue: GitHub.