invalid_client

Code: invalid_client · Shape: partner

Meaning#

KEYRA rejected the client credentials or client id for this request.

Likely causes#

1. Missing Authorization header
2. Bearer value is not clientId:clientSecret for Partner/secret APIs
3. Sandbox credentials used against a production project (or the reverse)
4. Publishable key used where a secret is required
5. Wrong client id on OAuth validate / token exchange

How to diagnose#

• Confirm HTTP 401 and error === invalid_client
• Log only whether Authorization was present — never log the secret
• Compare clientId prefix (cp_test_ vs cp_prod_) to project environment
• For Partner APIs: Authorization: Bearer {clientId}:{clientSecret}

How to fix#

• Use secret credentials on the server only
• Match credential environment to the project
• For OAuth browser start, use the publishable client id; validate with the same project’s credentials on the server

Retry behavior#

Do not retry until credentials are corrected.

Related#

API: POST /v1/identities/status, POST /v1/auth/challenge, POST /oauth/token, POST /verify/validate

SDK: createKeyraPartner2FA(), createKeyraServer(), createKeyraAuth(), createKeyraPartner2FA()

Troubleshooting: credentials, network

Guides: API Keys & Credentials, Environments