usebruno/bruno · error · Error

Unsupported grant type: ${grantType}. Supported types: clien

Error message

Unsupported grant type: ${grantType}. Supported types: client_credentials, password

What it means

Thrown by getOAuth2AccessToken when grantType is present and non-empty but is not one of the two supported values ('client_credentials' or 'password'). The check uses Array.includes, so even a typo or extra whitespace will fail it.

Source

Thrown at packages/bruno-requests/src/auth/oauth2-helper.ts:341

    credentialsId = 'default',
    autoFetchToken = true,
    tokenSource = 'access_token'
  } = oauth2Config;

  if (verbose) {
    debug.enable('oauth2');
  }

  if (!grantType) {
    throw new Error('Grant type is required for OAuth2');
  }

  if (!accessTokenUrl) {
    throw new Error('Access token URL is required for OAuth2');
  }

  if (!['client_credentials', 'password'].includes(grantType)) {
    throw new Error(`Unsupported grant type: ${grantType}. Supported types: client_credentials, password`);
  }

  // Check if we already have credentials stored
  const existingToken = await tokenStore.getCredential({ url: accessTokenUrl, credentialsId });

  if (existingToken) {
    // Check if token is expired
    if (!isTokenExpired(existingToken)) {
      // Token is valid, use it
      return tokenSource === 'id_token' ? existingToken.id_token : existingToken.access_token;
    } else {
      // Token is expired
      if (autoFetchToken) {
        // Clear expired token and proceed to fetch new token
        await tokenStore.deleteCredential({ url: accessTokenUrl, credentialsId });
      } else {
        // Return expired token if autoFetchToken is disabled
        return tokenSource === 'id_token' ? existingToken.id_token : existingToken.access_token;

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Use exactly 'client_credentials' or 'password' (underscores, no whitespace).
2. If you need authorization_code or refresh_token flows, this helper does not support them — use a different OAuth2 library (e.g. openid-client).
3. Trim and normalize the grantType string before passing it in.

Example fix

// before
const config = { grantType: 'authorization_code', accessTokenUrl: url, clientId: id };

// after
// Use a library that supports auth-code flow, OR:
const config = { grantType: 'client_credentials', accessTokenUrl: url, clientId: id, clientSecret: secret };

const SUPPORTED = ['client_credentials', 'password'];
if (!SUPPORTED.includes(config.grantType)) throw new Error(`Unsupported grantType: ${config.grantType}`);

function isSupportedGrantType(c) {
  return c.grantType === 'client_credentials' || c.grantType === 'password';
}

try { await getOAuth2AccessToken(config, tokenStore); }
catch (e) { if (e.message.startsWith('Unsupported grant type')) { /* pick a supported flow */ } else throw e; }

When it happens

Trigger: grantType set to 'authorization_code', 'refresh_token', 'implicit', a misspelling like 'client-credentials', or a value with leading/trailing whitespace.

Common situations: User selected an unsupported grant type in a generic OAuth2 form; migrating from another library that supported more grant types; whitespace introduced by copy-paste from a doc.

Related errors

• Access Token URL is required for OAuth2 client credentials f
• Client ID is required for OAuth2 client credentials flow
• Access Token URL is required for OAuth2 password credentials
• Username is required for OAuth2 password credentials flow
• Password is required for OAuth2 password credentials flow

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/c005d1790f88dd0a. Report an issue: GitHub.