https://www.rfc-editor.org/info/rfc6749/#section-5.2 clearly establishes that *invalid_client* is a valid response. While initially this is only defined in the terms of the implicit grant which is why it focuses on the "access token response". With the rejection of the implicit grant, the permanent registry of the authorize endpoint remains.
Regardless of the explicit expectation of the suggested flow where the error is returned, is there something you are concerned with? On Sun, Sep 20, 2026 at 11:16 PM Emelia S. <[email protected]> wrote: > Hi Warren, > > Can you cite a specification that makes invalid_client valid for usage > with the authorization endpoint? I can't see any specification text for > this. > > Thanks, > Emelia > > On 20 Sep 2026, at 18:58, Warren Parad <[email protected]> > wrote: > > Yes it's valid. No it isn't redirectable. > > On Sun, Sep 20, 2026, 18:37 Emelia S. <emelia= > [email protected]> wrote: > >> Hi all, >> >> In the OAuth Extensions Error Registry managed by IANA, invalid_client is >> listed as having a usage location of "token endpoint, authorization >> endpoint", citing RFC6749, however, RFC6749's Section 4.1.2.1 >> "Authorization Code Grant -> Authorization Response -> Error Response" does >> not list invalid_client. >> >> https://www.iana.org/assignments/oauth-parameters#extensions-error >> >> I'm not sure where the IANA registry contents is from, given that RFC6749 >> does not include the initial registry contents. The only place >> invalid_client is listed in RFC6749 is on the token endpoint. >> >> Can someone clarify if `invalid_client` is valid for the authorization >> endpoint and if that error is redirectable? >> >> — Emelia >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] > > >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
