Auth0 "Grant type not allowed for the client" in CI

By Kaveh Alemi·Latchkey

Auth0 rejected the token request because the application is not permitted to use that grant type. The Advanced settings of the Auth0 app must list the grant, or client_credentials will not be allowed.

What this error means

A token request to Auth0 returns "error":"unauthorized_client" with "Grant type 'client_credentials' not allowed for the client." The client_id and secret are valid.

{"error":"unauthorized_client","error_description":"Grant type 'client_credentials' not allowed for the client.","error_uri":"https://auth0.com/docs/clients/client-grant-types"}

Common causes

The grant is not enabled on the Auth0 application

Auth0 apps list allowed grant types in Advanced Settings; if client_credentials is not enabled, the request is refused.

Using a non machine-to-machine app type

A Single Page or Native app cannot use client_credentials; it needs a Machine to Machine application.

How to fix it

Enable the grant on a Machine to Machine app

1. Create or use a Machine to Machine application in Auth0.
2. Enable the client_credentials grant in Advanced Settings.
3. Authorize the app for the API and required scopes.

curl -s -X POST "https://$AUTH0_DOMAIN/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{"grant_type":"client_credentials","client_id":"'$CID'","client_secret":"'$CSECRET'","audience":"'$API'"}'

Match the app type to the flow

Use a Machine to Machine app for CI token requests instead of an interactive app type.

How to prevent it

• Use a dedicated Machine to Machine app for CI.
• Enable only the grant types each Auth0 app needs.
• Authorize the app for the API audience it calls.

Frequently asked questions

Related guides

References

• GitHub Actions documentation