Troubleshooting · Developer docs

Troubleshooting

Grouped by symptom, never by module, because the person with the problem does not know which module has it. One hundred questions across ten pages, each answered with the causes in the order they usually turn out to be true.

Answer Members and authentication

OAuth returns an invalid client error

Published

Two different things are called OAuth on a Core dna site, and the error means something different in each.

Your application gets tokens from the site (the site is the OAuth server):

  • The client's credentials are in a Basic header. The site's metadata lists client_secret_basic, but the token endpoint reads client_id and client_secret from the request body only. A Basic header is taken as a backend user's username and password instead, and the request is refused with a 403 HTML page before the OAuth server sees it. Send both in the body. Many OAuth libraries default to Basic, so set this explicitly. (Checked on two sites, 5 October 2026.)
  • The client id does not exist here. The answer is HTTP 400, {"error":"invalid_client"}. Clients are stored per environment, so an id registered on staging does not exist on production.
  • A confidential client sent no secret, or an old one. A client registered with a secret must send it on every token request, refreshes included. Regenerating the secret in the admin invalidates the old one at once.

At the authorize step, an unknown client id or an unregistered redirect URI is not sent back to your application: the site shows the error itself, because it cannot trust a redirect URI it cannot match to a client.

Shell 
curl https://www.example.com/oauth/token \
  -d grant_type=authorization_code \
  -d code=THE_CODE \
  -d redirect_uri=https://app.example.org/callback \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d code_verifier=THE_VERIFIER

The site signs members in with Google, Microsoft or Facebook (the site is the client): the error comes from the provider. Google shows it on its own page when the client ID is wrong or the OAuth client was deleted. A Microsoft secret that is wrong or has expired fails the code exchange, and the site shows authorization_failed_or_incomplete. Copy the ID and secret again from the provider's console. Microsoft secrets expire on a date chosen when they are created, so record it and renew the secret before then.

In the API reference: Exchange the code for tokens.

More in Members and authentication

  1. A member can log in but sees the logged-out header
  2. A member is logged out at random
  3. The password reset email never arrives
  4. A frontend user can reach an admin URL
  5. A custom my-account page is not found

Was this page helpful?

Your answer goes to the docs team.