Yes, Section 5.2 establishes invalid_client as a valid error code for usage within the token endpoint, *not* the authorization endpoint. Implicit grant's Section 4.2.2.1 does not use invalid_client, and the only other authorization request that contains error response is the authorization code error response, which also does not include invalid_client.
Nothing in the implicit grant states that the entire "Issuing an access token"'s error responses applies, given it declares it's own error responses. — Emelia > On 21 Sep 2026, at 01:20, Warren Parad <[email protected]> wrote: > > https://www.rfc-editor.org/info/rfc6749/#section-5.2 clearly establishes that > invalid_client is a valid response. While initially this is only defined in > the terms of the implicit grant which is why it focuses on the "access token > response". With the rejection of the implicit grant, the permanent registry > of the authorize endpoint remains. > > Regardless of the explicit expectation of the suggested flow where the error > is returned, is there something you are concerned with? > > On Sun, Sep 20, 2026 at 11:16 PM Emelia S. <[email protected] > <mailto:[email protected]>> wrote: >> Hi Warren, >> >> Can you cite a specification that makes invalid_client valid for usage with >> the authorization endpoint? I can't see any specification text for this. >> >> Thanks, >> Emelia >> >>> On 20 Sep 2026, at 18:58, Warren Parad <[email protected] >>> <mailto:[email protected]>> wrote: >>> >>> Yes it's valid. No it isn't redirectable. >>> >>> On Sun, Sep 20, 2026, 18:37 Emelia S. >>> <[email protected] >>> <mailto:[email protected]>> wrote: >>>> Hi all, >>>> >>>> In the OAuth Extensions Error Registry managed by IANA, invalid_client is >>>> listed as having a usage location of "token endpoint, authorization >>>> endpoint", citing RFC6749, however, RFC6749's Section 4.1.2.1 >>>> "Authorization Code Grant -> Authorization Response -> Error Response" >>>> does not list invalid_client. >>>> >>>> https://www.iana.org/assignments/oauth-parameters#extensions-error >>>> >>>> I'm not sure where the IANA registry contents is from, given that RFC6749 >>>> does not include the initial registry contents. The only place >>>> invalid_client is listed in RFC6749 is on the token endpoint. >>>> >>>> Can someone clarify if `invalid_client` is valid for the authorization >>>> endpoint and if that error is redirectable? >>>> >>>> — Emelia >>>> _______________________________________________ >>>> OAuth mailing list -- [email protected] <mailto:[email protected]> >>>> To unsubscribe send an email to [email protected] >>>> <mailto:[email protected]> >>> _______________________________________________ >>> OAuth mailing list -- [email protected] <mailto:[email protected]> >>> To unsubscribe send an email to [email protected] >>> <mailto:[email protected]> >>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
