Error map
invalid_client OAuth 2.0 Error: invalid_client
Authentication · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
API Error: Invalid API Key / Incorrect API key provided
The API didn’t recognise the key sent with the request — it’s wrong, revoked, from another environment, or sent in the wrong plac…
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
OAuth Error: redirect_uri_mismatch
The redirect URI in your OAuth request doesn’t exactly match one registered for the client in the provider’s console.
Firebase Auth: auth/popup-closed-by-user / auth/popup-blocked / auth/cancelled-popup-request
The OAuth popup for Google/GitHub sign-in was closed, blocked by the browser, or replaced by another popup request.
AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x
The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrongly.
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
Google Sign-In: com.google.android.gms.common.api.ApiException: 10 (DEVELOPER_ERROR)
Google Sign-In is misconfigured — the app’s package name or SHA-1/SHA-256 signing fingerprint isn’t registered in Google Cloud/Fi…
GitHub OAuth: {"error":"bad_verification_code","error_description":"The code passed is incorrect or expired."}
The authorization code sent to GitHub’s token endpoint was already used, expired (10 minutes), or belongs to another OAuth app.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
AADSTS7000222: The provided client secret keys for app are expired
The app registration’s client secret has expired, so service-to-service authentication fails.
AADSTS500113: No reply address is registered for the application
The app registration has no redirect URI for the platform being used, so Entra ID has nowhere to send the response.
Two steps away (36)
HTTP 400 Bad Request
The server could not understand the request because its syntax, headers or body are malformed or invalid.
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
Azure AD (Entra ID): AADSTS50076 / AADSTS50079 — multi-factor authentication required
A Conditional Access policy requires MFA, but the sign-in flow (often a script, legacy client or ROPC password grant) can’t compl…
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
Kubernetes: ImagePullBackOff / ErrImagePull
The node can’t pull the container image — wrong name/tag, missing registry credentials, or registry unreachable.
HTTP 407 Proxy Authentication Required
A proxy between you and the server requires credentials before it will forward your request.
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
hint: You have divergent branches and need to specify how to reconcile them.
Git 2.27+ asks you to choose merge, rebase or fast-forward-only when local and remote both have new commits.
Author identity unknown *** Please tell me who you are.
Git doesn’t know your name and email for commits.
warning: in the working copy of 'x', LF will be replaced by CRLF the next time Git touches it
Git’s line-ending conversion (core.autocrlf) will change line endings in your working copy.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
QuotaExceededError: Failed to execute 'setItem' on 'Storage': Setting the value exceeded the quota
localStorage/sessionStorage is full (about 5 MB per origin) or storage is disabled.
NotAllowedError: play() failed because the user didn't interact with the document first.
The browser blocked media autoplay with sound until the user interacts with the page.
{"message":"Missing Authentication Token"} / No authorization token was found
The request reached a protected endpoint without credentials — or, on AWS API Gateway, it hit a path/method that doesn’t exist.
Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift)
The 6-digit authenticator code is rejected — usually because the phone’s or server’s clock is off, or the secret was enrolled twi…
bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required
bcrypt.compare/hash received undefined — the password field or stored hash wasn’t passed.
java.nio.file.AccessDeniedException: /path
The OS denied a file operation to the Java process.
NotAllowedError: Failed to execute 'writeText' on 'Clipboard': Document is not focused.
The Clipboard API refused to write — the page isn’t focused, there was no user gesture, or the context isn’t secure.
Error: listen EACCES: permission denied 0.0.0.0:80
Node isn’t allowed to bind that port — ports below 1024 need root on Linux/macOS, and some Windows ports are reserved.
Android: INSTALL_FAILED_UPDATE_INCOMPATIBLE
An app with the same package name but a different signing key is already installed on the device.
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…
error: gpg failed to sign the data — fatal: failed to write commit object
Commit signing is enabled but GPG couldn’t sign — no TTY for the passphrase, wrong key, or agent not running.
OAuth 2.0 Error: access_denied (The user or authorization server denied the request)
The authorization request was refused — the user clicked Cancel/Deny on the consent screen, or a policy denied access.
OAuth 2.0 Error: unsupported_grant_type
The token endpoint didn’t recognise grant_type — usually because the body wasn’t sent as application/x-www-form-urlencoded, or th…
OAuth 2.0 Error: unsupported_response_type
The authorize request asked for a response_type the client or server doesn’t allow — e.g. token (implicit) when only code is enab…
fatal: Authentication failed for 'https://github.com/x/y.git/'
HTTPS authentication to the Git host failed — wrong or expired credentials, or a password used where a token is required.
Host key verification failed. fatal: Could not read from remote repository.
SSH doesn’t trust the server’s host key — first connection in a non-interactive environment, or the key changed.
! [remote rejected] … (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/x.yml` without `workflow` scope)
Your token can’t modify GitHub Actions workflow files without the workflow scope.
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
ECS: ResourceInitializationError: unable to pull secrets or registry auth
Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting containers.
AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application
The signed-in user belongs to another tenant (or is a personal Microsoft account) and isn’t a guest in the app’s tenant.
AADSTS50126: Error validating credentials due to invalid username or password
Microsoft Entra ID (Azure AD) rejected the sign-in because the username or password is wrong — or the flow can’t use passwords fo…
AADSTS65001: The user or administrator has not consented to use the application
The app needs permissions that haven’t been granted for this user or tenant.
AADSTS90002: Tenant 'x' not found
The tenant ID or domain in the authority URL doesn’t exist — or isn’t in the cloud you’re calling (public vs government/China).
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException