Account is not fully set up 🔐 Authentication

Keycloak: invalid_grant — Account is not fully set up

The user has pending required actions (verify email, update password, configure OTP), so non-interactive token requests (password grant) fail.

Seen on: REST API

Meaning

Required actions can only be completed in the browser login flow. Clear them for service/test users or log in interactively once.

Common causes

  • Required actions on the user (Verify Email, Update Password, Configure OTP)
  • Password grant used for a user with pending actions
  • Temporary password set by an admin

⚡ Quick fix

  1. Remove required actions in the admin console (Users → Details)
  2. Set non-temporary passwords for test/service users
  3. Use the browser flow to complete actions

Detailed fix by platform

Shell

  1. bash
    # kcadm
/opt/keycloak/bin/kcadm.sh update users/$USER_ID -r myrealm -s 'requiredActions=[]'

How to diagnose

  1. User — Required actions list
  2. Password — Temporary?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.