OAuth2 "unsupported_grant_type" at the token endpoint in CI

By Kaveh Alemi·Latchkey

The OAuth2 token endpoint does not recognize the grant_type you sent, or it never received it because the body was not form-encoded. The response is 400 with "error":"unsupported_grant_type".

What this error means

A token request returns "error":"unsupported_grant_type". Often the grant_type is misspelled, or the request sent JSON instead of application/x-www-form-urlencoded so the field was not parsed.

HTTP/1.1 400 Bad Request

{"error":"unsupported_grant_type","error_description":"The authorization grant type is not supported by the authorization server."}

Common causes

A misspelled or unsupported grant_type

Values like "client_credential" (missing s) or a grant the server does not offer are rejected.

Wrong content type on the request

The token endpoint expects application/x-www-form-urlencoded. Sending JSON means grant_type is not parsed, so it looks unsupported.

How to fix it

Send a form-encoded body with a valid grant_type

1. Use Content-Type: application/x-www-form-urlencoded.
2. Send an exact supported grant_type, e.g. client_credentials.
3. Do not send the parameters as a JSON object.

curl -s -X POST "$TOKEN_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials

Confirm the server supports the flow

Check the provider metadata (grant_types_supported in .well-known/openid-configuration) to confirm the grant is offered.

How to prevent it

• Always POST the token request as form-urlencoded.
• Copy grant_type values from the provider metadata to avoid typos.
• Assert on grant_types_supported before using a flow.

Frequently asked questions

Related guides

References

• GitHub Actions documentation