# InvalidClient Error when sign in by mobile sdk

**URL:** <https://devforum.okta.com/t/invalidclient-error-when-sign-in-by-mobile-sdk/31497>\
**Category:** OAuth/OIDC\
**Tags:** ios, swift\
**Created:** [December 17, 2024, 2:07pm UTC](https://devforum.okta.com/t/invalidclient-error-when-sign-in-by-mobile-sdk/31497 "2024-12-17T14:07:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ccmhwy](https://avatars.discourse-cdn.com/v4/letter/c/7ba0ec/32.png) [@ccmhwy](https://devforum.okta.com/u/ccmhwy)\
**Post date:** [December 17, 2024, 2:07pm UTC](https://devforum.okta.com/t/invalidclient-error-when-sign-in-by-mobile-sdk/31497/1 "2024-12-17T14:07:29Z")

</div>

Hi,

1. I have created an Web type Application on Okta with the Grant Type as “Authorization Code”.
2. set Sign-in redirect URI: com.franklinwh.oktaExample:/callback
3. clone okta-mobile-swift sdk and set configuration items in plist

```auto
issuer: https://dev-xxxxxxx.okta.com/oauth2/default
clientId: 0oalwn1m520rmgQap5d7
redirectUri: com.franklinwh.oktaExample:/callback

```

1. run WebSignIn (iOS) sample and sign in with user name and password
2. got error when exchange token in the OAuth2 sdk

```auto
Printing description of result:
▿ Result<APIResponse<Token>, APIClientError>
  ▿ failure : APIClientError
    ▿ serverError : OAuth2ServerError
      - code : AuthFoundation.OAuth2ServerError.Code.invalidClient
      ▿ description : Optional<String>
        - some : "Client authentication failed. Either the client or the client credentials are invalid."
      - additionalValues : 0 elements

```

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/8/8e1970f6616f5a3f4b11193914c77bda4f0e9804.jpeg)

and the exchange request is:

```auto
▿ TokenRequest
  ▿ openIdConfiguration : OpenIdConfiguration
    ▿ jsonPayload : <AnyJSON: 0x600002628720>
    ▿ issuer : https://dev-xxxxxx.okta.com/oauth2/default
      - _url : https://dev-xxxxxx.okta.com/oauth2/default
      - _parseInfo : nil
      - _baseParseInfo : nil
    ▿ authorizationEndpoint : https://dev-xxxxxx.okta.com/oauth2/default/v1/authorize
      - _url : https://dev-xxxxxx.okta.com/oauth2/default/v1/authorize
      - _parseInfo : nil
      - _baseParseInfo : nil
    ▿ tokenEndpoint : https://dev-xxxxxx.okta.com/oauth2/default/v1/token
      - _url : https://dev-xxxxxx.okta.com/oauth2/default/v1/token
      - _parseInfo : nil
      - _baseParseInfo : nil
    ▿ jwksUri : https://dev-xxxxxx.okta.com/oauth2/default/v1/keys
      - _url : https://dev-xxxxxx.okta.com/oauth2/default/v1/keys
      - _parseInfo : nil
      - _baseParseInfo : nil
    ▿ responseTypesSupported : 6 elements
      - 0 : "code"
      - 1 : "id_token"
      - 2 : "code id_token"
      - 3 : "code token"
      - 4 : "id_token token"
      - 5 : "code id_token token"
    ▿ subjectTypesSupported : 1 element
      - 0 : "public"
    ▿ idTokenSigningAlgValuesSupported : 1 element
      - 0 : AuthFoundation.JWK.Algorithm.rs256
  ▿ clientConfiguration : <Configuration: 0x60000291c000>
  - redirectUri : "com.franklinwh.oktaExample:/callback"
  - grantType : AuthFoundation.GrantType.authorizationCode
  - grantValue : "TKK0occjSgGPYApUWHV-hOLgeFTEH1zMqoO3kdUsEOk"
  ▿ pkce : Optional<PKCE>
    ▿ some : PKCE
      - codeVerifier : "zoDNfllsZDiqvyFzkAlrUKg_4AL0NnxQO7Qx5qlyEDs"
      - codeChallenge : "a7XlE0B7U-fvjatUA90uUeg4JtyWUbjaSM6Yrs6r_Uw"
      - method : AuthFoundation.PKCE.Method.sha256
  ▿ nonce : Optional<String>
    - some : "DJhZW1UU5yX58Lp_FDI6yA"
  - maxAge : nil

```

So what’s the problem? You can check my application configuration by clientId: 0oalwn1m520rmgQap5d7

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [December 17, 2024, 4:31pm UTC](https://devforum.okta.com/t/invalidclient-error-when-sign-in-by-mobile-sdk/31497/2 "2024-12-17T16:31:58Z")

</div>

Can you try creating a Native app within Okta instead and ensure that its `Client authentication` is set to `None` and that the `Require PKCE as additional verification` is selected next to `Proof Key for Code Exchange (PKCE)` as depicted in my screenshot below? These are also the default options set when you create a Native OIDC app.

 ![Screenshot 2024-12-17 at 8.31.14 AM](https://global.discourse-cdn.com/oktadev/original/2X/d/d1402f3642b767446815417773708e1ca1759f0a.png)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [December 19, 2024, 2:45am UTC](https://devforum.okta.com/t/invalidclient-error-when-sign-in-by-mobile-sdk/31497/4 "2024-12-19T02:45:17Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.