Back to error codes
ERROR invalid_client
OAuth 2.0 Invalid Client
OAuth Error
The client authentication failed, the client_id or client_secret is invalid.
Root Cause
Wrong client_id or client_secret, the client is not registered, or the credentials were revoked.
How to Fix
Verify the client_id and client_secret in your OAuth provider's dashboard. Ensure you are using the correct credentials for the environment (dev vs prod).
Quick Summary
OAuth invalid_client: the client_id or client_secret is wrong or revoked. Verify credentials in your OAuth provider's dashboard. Use different credentials per environment.
Key Takeaways
Key Takeaways
- client_id identifies the application; client_secret authenticates it
- Verify credentials in the OAuth provider's dashboard (Google, GitHub, Auth0, etc.)
- Use different client credentials per environment (dev, staging, prod)
- Never commit client secrets to source control, use environment variables
Use Cases
When to use it
- Wrong client_secret in environment variables
- Using dev credentials in production
- Client credentials were rotated
Watch out
Common Mistakes
- Committing client secrets to source control, use environment variables or a secrets manager
- Using the same credentials across environments, create separate OAuth apps per environment
FAQ
invalid_client OAuth 2.0 Invalid Client, Frequently Asked
How do I rotate OAuth client credentials safely?
Create new credentials in the provider dashboard, update your environment variables, deploy, then revoke the old credentials.
Still having issues?
Check your network logs or use our developer tools to inspect headers, decode tokens, or validate your requests.