---
schema_version: "1"
id: 1d2b2f5788d5e5a5d9f09fb55735764986f35837e31199db508f8aedd3b21dc3
title: OAuth 2.0 Authorization Errors
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_flow_errors.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0434f988984bc9a33427cd8df5143f37f41955939de3aec0b77a2e6f3c19f6af
description: Errors can occur during OAuth authorization. For example, a user denies access to the connected app or request parameters are incorrect. When errors occur, the authorizing server sends an error to the callback URL with an error code.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Authorization Errors

Errors can occur during OAuth authorization. For example, a user denies access to the connected app or request parameters are incorrect. When errors occur, the authorizing server sends an error to the callback URL with an error code.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

OAuth authorization errors have different formats depending on the authorization flow. Here are examples from each of the supported OAuth flows.

- This error is from an OAuth 2.0 web server flow, in which the user denied access to the connected app:
    
    ```
    https://www.mycustomerorderstatus/code_callback.jsp?error=access-denied
    ```
- Here’s the same error from an OAuth 2.0 user-agent flow:
    
    ```
    https://www.customercontactinfo.com/user_callback.jsp#error=access_denied
    ```
- If an error occurs in the OAuth 2.0 JWT bearer flow, the authorizing server replies with a standard OAuth error response. The response includes the reasons why the token is considered invalid. For more information, see [https://tools.ietf.org/html/rfc7523](https://tools.ietf.org/html/rfc7523). This example shows a sample error response in JSON format.
    
    `HTTP/1.1 400 Bad Request Content-Type: application/json Cache-Control: no-store {   "error":"invalid_grant",   "error_description":"Audience validation failed" }`
- The following is an example of a returned error from an OAuth 2.0 refresh token flow.
    
    ```
    {"error":"invalid_grant","error_description":"expired access/refresh token"}
    ```
- This sample error response occurred while processing the SAML bearer assertion.
    
    ```
    HTTP/1.1 400 Bad Request
    Content-Type: application/json
    Cache-Control: no-store
    {
      "error":"invalid_grant",
      "error_description":"Audience validation failed"
    }
    ```
- Here’s an example error from a SAML assertion flow. This flow includes an error URI, which is a link to the SAML Assertion Validator. The validator contains more information about the failure. The error URI is returned only when Salesforce can parse the assertion.
    
    ```
    {"error_uri":"https://yourInstance.salesforce.com/setup/secur/SAMLValidationPage.apexp",
    "error":"invalid_grant","error_description":"invalid assertion"} 
    ```

## Error Codes

To help troubleshoot why an error occurred, review the following error codes and causes.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d46406e121">Error</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d46406e124">Cause</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>access_denied</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">User denied access to the client app.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>authorization_pending</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">For the device flow, the user hasn’t approved the device for access
              yet.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>CSRF</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Salesforce detected a possible Cross-Site Forgery Request (CSRF) attack. We
              couldn't verify that the request to log in came from the correct domain.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>ERROR_CREATING_USER</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">
              <p>One of these scenarios has occurred.</p>
              <ul>
                <li>The username isn't unique.</li>
                <li>A contact exists for that email address.</li>
                <li>The user doesn't have a license.</li>
                <li>You exceeded your org's storage limit.</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>immediate_unsuccessful</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">The <code>immediate</code> parameter is set to <code>true</code>, and the user isn’t logged in or hasn’t
              previously approved the client’s access.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>inactive_org</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Org is locked, closed, or suspended.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>inactive_user</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">User is set to inactive by the org’s admin.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_app_access</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">User isn’t approved by an admin to access this app.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_assertion_type</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Specified assertion type isn’t supported.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_client</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Client secret is invalid.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_client_id</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Client identifier is invalid.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_grant</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">
              <p>One of the following:</p>
              <ul>
                <li>Invalid authorization code. For the SAML assertion flow, make sure that the
                  client sends a URL-encoded <code>assertion</code> and
                  <code>assertion_type</code>.
                </li>

                <li>Invalid user credentials.</li>

                <li>Invalid user.</li>

                <li>Invalid assertion.</li>

                <li>Invalid audience.</li>

                <li>IP restricted or invalid login hours.</li>

                <li>Indicates that the <code>code_verifier</code> value was invalid (not
                  base64 encoded, for example) or wasn’t the valid verifier for the given
                  <code>code_challenge</code>.
                </li>

                <li>Indicates that a <code>code_challenge</code> wasn’t specified, so the
                  <code>code_verifier</code> wasn’t expected but was specified.
                </li>

                <li>User hasn’t approved the connected app.</li>

                <li>Authentication failure.</li>

                <li>For the device flow, the device flow isn’t enabled for the connected app or
                  the Salesforce server isn’t able to grant an access token.</li>

                <li>For the refresh token flow, the refresh or access token is expired.</li>

                <li>For the client credentials flow, the request isn't supported for the host
                  domain. For this flow, requests to
                  <samp class="filepath">https://login.salesforce.com</samp> and
                  <samp class="filepath">https://test.salesforce.com</samp> aren't supported. Use your My
                  Domain URL instead.
                </li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_request</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">
              <p>One of the following errors.</p>
              <ul>
                <li>HTTPS is required.</li>
                <li>HTTP GET is required.</li>
                <li>HTTP POST is required.</li>
                <li>The <samp class="parmname">code_challenge</samp> value was invalid, such as not being
                  base64 encoded.</li>
                <li>Flow doesn’t support and didn’t expect a <samp class="parmname">code_challenge</samp>
                  parameter.</li>
                <li>Out-of-band isn’t supported.</li>
                <li>The JWT bearer and SAML assertion bearer flows require a <code>refresh_token</code> scope. Install and preauthorize the
                  app.</li>
                <li>For the device flow, the device code specified in the polling request is
                  invalid.</li>
                <li>For the username-password flow, the <samp class="parmname">scope</samp> parameter isn’t
                  supported.</li>
                <li>For the refresh token flow, the secret type isn’t supported.</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>invalid_scope</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">The requested scope is invalid, unknown, or malformed.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>NO_ACCESS</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Unable to find a user. For example, there's no username.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>No_OAuth_State</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">The OAuth state was tampered with or is missing.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>No_Openid_Response</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">User Info Endpoint URL is invalid.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>rate_limit_exceeded</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Number of login attempts has been exceeded.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>redirect_uri_mismatch</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Redirect URI mismatch with connected app definition.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>redirect_uri_missing</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Redirect URI not provided.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>REGISTRATION_HANDLER_ERROR</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">For authentication providers, there's a problem with your registration handler
              Apex code.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>server_error</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">The number of authorization requests from the client app exceeds the hourly
              limit.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>slow_down</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">For the device flow, the client app is polling the authorization server more
              frequently than the recommended minimum interval.</td>

          </tr>
          <tr class="">
            <td data-label="Error" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e121 ">
              <code>unsupported_response_type</code>
            </td>

            <td data-label="Cause" class="slds-cell-wrap" style="vertical-align:top;" headers="d46406e124 ">Requested response type isn’t supported.</td>

          </tr>
        </tbody>
      </table>