# Client authentication using private\_key\_jwt failing with "Cannot supply multiple credentials" **URL:** \ **Category:** Questions\ **Created:** [May 14, 2020, 3:40pm UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381 "2020-05-14T15:40:18Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![padonnelly](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@padonnelly](https://devforum.okta.com/u/padonnelly)\ **Post date:** [May 14, 2020, 3:40pm UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/1 "2020-05-14T15:40:18Z")
Client authentication to token endpoint using private\_key\_jwt “failing with invalid\_request (Cannot supply multiple client credentials” I have added an Oauth 2 client app using the api. I have included a public key that corresponds to the private key that is used to generate the client assertion. From my traces I can see the POST to the token endpoint which includes the client assertion in the body. I don’t see any other credentials in the header of the request. Yet I still received the response “Cannot supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a client\_assertion in the post body”. Any clues about how to troubleshoot this? ---
**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\ **Post date:** [May 14, 2020, 6:33pm UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/2 "2020-05-14T18:33:13Z")
Hi @padonnelly, Can you post your request here? I have been able to get the access token from /token endpoint using postman successfully before. Also, if you tell us how you created the OAuth 2 client app, that might be helpful. Regards, Vijet ---
**Author:** ![padonnelly](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@padonnelly](https://devforum.okta.com/u/padonnelly)\ **Post date:** [May 15, 2020, 9:08am UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/3 "2020-05-15T09:08:18Z")
Vijet - thanks for responding. (subject to the five link limit) here is request and response, and also the client application config. –\> POST [https://dev-605035.okta.com/oauth2/default/v1/token](https://dev-605035.okta.com/oauth2/default/v1/token) –\> HEADERS { ‘user-agent’: ‘openid-client/3.12.2 ([https://github.com/panva/node-openid-client](https://github.com/panva/node-openid-client))’, accept: ‘application/json’, ‘accept-encoding’: ‘gzip, deflate’, ‘content-type’: ‘application/x-www-form-urlencoded’, ‘content-length’: 997 } –\> BODY grant\_type=authorization\_code&code=1BUAg8LpA8ENui043UCS&redirect\_uri=https%3A%2F%[2Fcareappconnect.ngrok.io](http://2Fcareappconnect.ngrok.io)%2Fauth%2Fnhssandbox%2Fredirect&client\_id=0oa3w0bdzqtM8i181357&client\_assertion=eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCIsImtpZCI6InVvYmQ2SjZJakpxYTE1cDVsbHhGY1RyakxzbVV2cDZ0ZjRNUURyTjI5aFkifQ.eyJpYXQiOjE1ODk1MzI4MTMsImV4cCI6MTU4OTUzMjg3MywianRpIjoiY1g0TDBxR1JSU095X1RvRHFkT0VFVW9nU1hOS0JOdzBzcEt1M2ZIZnJNVSIsImlzcyI6IjBvYTN3MGJkenF0TThpMTgxMzU3Iiwic3ViIjoiMG9hM3cwYmR6cXRNOGkxODEzNTciLCJhdWQiOiJodHRwczovL2Rldi02MDUwMzUub2t0YS5jb20vb2F1dGgyL2RlZmF1bHQvdjEvdG9rZW4ifQ.IWY\_fMPFSxu6eYgoxCVge-OF6b8mUcrKnWRqT3R6dRDzLe5lr5WvQRp2K4AHfxrMWBN8V-fuYpJs6JoreF7Gnmc06aCd9BVV4IH312UlXzQRtxvcDaepi6bHLBKowiZZIOZ7dFgYrnZgQq3YuaEl\_dzI-eO73wNGdT55qMJEZ5w9Z-KTVFbFiMTmQkkskrkJCivfzad4Kj\_xZTTXzsZA\_-n\_q3bFeCPqnDF1So6z60rcibM5Ref\_VFkyM-CXjkzBTCw5GxK0Oz2hy7SgKml0x0IP764wk9ZqcFOlq03Snx-1mPvkoTD940e8-ppdbWjBX2cwUHOJXu4oMls33u4RxQ&client\_assertion\_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer \<-- 401 FROM POST [https://dev-605035.okta.com/oauth2/default/v1/token](https://dev-605035.okta.com/oauth2/default/v1/token) \<-- BODY {“error”:“invalid\_request”,“error\_description”:“Cannot supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a client\_assertion in the post body.”} ---
**Author:** ![padonnelly](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@padonnelly](https://devforum.okta.com/u/padonnelly)\ **Post date:** [May 15, 2020, 9:08am UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/4 "2020-05-15T09:08:49Z")
``` { "id": "0oa3w0bdzqtM8i181357", "name": "oidc_client", "label": "NHS Simulator", "status": "ACTIVE", "lastUpdated": "2020-05-14T13:28:29.000Z", "created": "2020-05-13T11:33:29.000Z", "accessibility": { "selfService": false, "errorRedirectUrl": null, "loginRedirectUrl": null }, "visibility": { "autoSubmitToolbar": false, "hide": { "iOS": true, "web": true }, "appLinks": { "oidc_client_link": true } }, "features": [], "signOnMode": "OPENID_CONNECT", "credentials": { "userNameTemplate": { "template": "${source.login}", "type": "BUILT_IN" }, "signing": { "kid": "A0JLuQsnm2vKLf8zjMkOwTftB7JzRitmXONa-h5BQh8" }, "oauthClient": { "autoKeyRotation": true, "client_id": "0oa3w0bdzqtM8i181357", "token_endpoint_auth_method": "private_key_jwt" } }, "settings": { "app": {}, "notifications": { "vpn": { "network": { "connection": "DISABLED" }, "message": null, "helpUrl": null } }, "oauthClient": { "jwks": { "keys": [ { "kty": "RSA", "kid": "uobd6J6IjJqa15p5llxFcTrjLsmUvp6tf4MQDrN29hY", "use": "sig", "e": "AQAB", "n": "lojuZLF9ocSWHCrLSdVSHmTzwTltjr_8r-nBrPRXjBuKheSdIVXpSVKNSX9qNSJKsS_XDgLuZXvCW1L-caT8ovEXGazmq6azrgwAz2eNUr2NpjqBLvmg1pI52tPBgE0Ld1HHFO2B6eBsocf8au9NqZj9jci3KB6ztCitNzUcp_HTeiH0gRAvwXIthikjIHrXzqzDm39mf03J2jhTvsVYDFMtXQ0N1E2DB84pC2UgUMbevbV9ov8uB3gAvKN6fDrFUg98-3-Yoc8XuOkfVV-bIKCtGsyG0NIJea0p5bvrmT4Kr3Ez5uRArYDA9KYBV6LA3MHKigcYaIwTDFGjJ--X_w" } ] }, "client_uri": null, "logo_uri": null, "redirect_uris": [ "https://careappconnect.ngrok.io/auth/nhssandbox/redirect" ], "response_types": [ "code" ], "grant_types": [ "authorization_code" ], "application_type": "web", "request_object_signing_alg": "RS512", "issuer_mode": "ORG_URL" } }, "_links": { "appLinks": [ { "name": "oidc_client_link", "href": "https://dev-605035.okta.com/home/oidc_client/0oa3w0bdzqtM8i181357/aln177a159h7Zf52X0g8", "type": "text/html" } ], "groups": { "href": "https://dev-605035.okta.com/api/v1/apps/0oa3w0bdzqtM8i181357/groups" }, "logo": [ { "name": "medium", "href": "https://ok7static.oktacdn.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png", "type": "image/png" } ], "users": { "href": "https://dev-605035.okta.com/api/v1/apps/0oa3w0bdzqtM8i181357/users" }, "deactivate": { "href": "https://dev-605035.okta.com/api/v1/apps/0oa3w0bdzqtM8i181357/lifecycle/deactivate" } } }, ``` ---
**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\ **Post date:** [May 15, 2020, 4:52pm UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/5 "2020-05-15T16:52:58Z")
Hi @padonnelly, Shouldn’t the `grant_type` parameter in body be `client_credentials`? Can you change that and give it a try? Another thing I can suggest is to try making a curl request by passing client\_assertion as a query parameter instead. Something like this ```auto curl -X POST "https://{yourOktaDomain}/oauth2/v1/token" -H "Accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials \ &client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \ &client_assertion=eyJhbGciOiJSUzI1…..feCJfSqsJeEKGjJqp1accnXpPbCSi1-2UQ" ``` ---
**Author:** ![padonnelly](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@padonnelly](https://devforum.okta.com/u/padonnelly)\ **Post date:** [May 15, 2020, 5:20pm UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/6 "2020-05-15T17:20:15Z")
The scenario I’m trying to implement needs an authorization code flow. The end user is logging on using Okta so that they give consent to a web application to access their user information held on okta. I will experiment with your suggestion - thanks. Although I’m puzzled because won’t a client secret be expected which would make the public/private key set arrangement superfluous? Paul ---
**Author:** ![rcodlin](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@rcodlin](https://devforum.okta.com/u/rcodlin)\ **Post date:** [July 2, 2021, 10:16am UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/7 "2021-07-02T10:16:54Z")
Was there are resolution to this issue? From my testing I receive this error if the “client\_id” value is included in the payload along with the client\_assertion and client\_assertion\_type. If the “client\_id” is removed then the authorization code flow works as expected. My concern is around compliance with other providers and having to implement a variation to support Okta. The examples provided in the Okta documentation include the “client\_id” parameter as part of the payload. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 8, 2024, 6:38pm UTC](https://devforum.okta.com/t/client-authentication-using-private-key-jwt-failing-with-cannot-supply-multiple-credentials/9381/8 "2024-02-08T18:38:02Z")