Client authentication failed. Either the client or the client credentials are invalid

Questions OAuth/OIDC
1

I have a angular + Java spring boot application, i have configured okta login for the application, and its working fine with local setup, now when moving it to server, i am getting okta login page, and able to complete 2FA as well, but it fails at the /oauth2/default/v1/token api, getting this error, “Client authentication failed. Either the client or the client credentials are invalid.” not sure what might be the issue and how to debug.

2

What type of application did you create within Okta and which part of your implementation is the one making that /oauth2/default/v1/token request, the Angular app or the Java app?

3

It is an angular frontend and backend (Spring Boot with security implementation) application, upon further investigating, the curl request for /token api is working when "Authorization: Basic clientId:clientSecret” is passed along, where to configure the same in angular, currently i followed GitHub - okta/okta-angular: Angular SDK for Okta's OIDC flow this implementation with a CustomCallbackComponent, not sure how to pass the Authorization explicitly.

4

Our Angular SDK is only designed to work with SPAs that use PKCE auth, and not a client that uses client_secret_basic client authentication.

If you create a SPA within Okta and use its ID in your configuration, does it work?

5

Yes, it works when creating a app in Okta as SPA, but when creating a web application in Okta and using its configuration in application I am getting this error, “Client authentication failed. Either the client or the client credentials are invalid” .

Could you please suggest how to configure spring boot security based application , with Angular frontend login page with okta login (Web application based) if Angular SDK does not support Web application.

6

Please suggest how to configure spring boot security based application , with Angular frontend login page with okta login (Web application based)

7

If you want to have the Angular SDK start Authorization Code flow for a Web app with a Client Secret, you will want ensure that pkce is set to false and responseType is set to code in your OktaAuth config, as mentioned in our docs here: GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API