Keycloak "invalid_grant: Account is not fully set up" in CI

By Kaveh Alemi·Latchkey

Keycloak refused the password grant because the test user has an unresolved required action, such as UPDATE_PASSWORD or VERIFY_EMAIL. It returns invalid_grant with "Account is not fully set up".

What this error means

A direct-grant token request for a seeded user returns "error":"invalid_grant" with "Account is not fully set up". The user exists but has pending required actions.

{"error":"invalid_grant","error_description":"Account is not fully set up"}

Common causes

The seeded user has required actions pending

Keycloak added default required actions (update password, configure OTP, verify email) that must be cleared before login succeeds.

Email not verified with a verify-email requirement

If the realm requires verified email, an unverified test user cannot complete the grant.

How to fix it

Seed the user with no required actions

1. Create the CI user with a permanent password and emailVerified true.
2. Set requiredActions to an empty list.
3. Then request the direct-grant token.

/opt/keycloak/bin/kcadm.sh create users -r ci \
  -s username=tester -s enabled=true -s emailVerified=true \
  -s 'requiredActions=[]'
/opt/keycloak/bin/kcadm.sh set-password -r ci --username tester \
  --new-password pass --temporary=false

Clear pending actions on an existing user

Update the user to remove requiredActions and mark email verified before running login tests.

How to prevent it

• Provision CI users with a permanent password and no required actions.
• Set emailVerified true when the realm requires it.
• Automate realm and user seeding as part of test setup.

Frequently asked questions

Related guides

References

• GitHub Actions documentation