[OAUTH-WG] Re: Possibly incorrect IANA registry contents for Error Registry

[Warren Parad <[e-mail]>]

https://www.rfc-editor.org/info/rfc6749/#section-5.2 clearly establishes
that *invalid_client* is a valid response. While initially this is only
defined in the terms of the implicit grant which is why it focuses on the
"access token response". With the rejection of the implicit grant, the
permanent registry of the authorize endpoint remains.

Regardless of the explicit expectation of the suggested flow where the
error is returned, is there something you are concerned with?

On Sun, Sep 20, 2026 at 11:16 PM Emelia S. <[e-mail]> wrote:

> Hi Warren,
>
> Can you cite a specification that makes invalid_client valid for usage
> with the authorization endpoint? I can't see any specification text for
> this.
>
> Thanks,
> Emelia
>
> On 20 Sep 2026, at 18:58, Warren Parad <wparad=[e-mail]>
> wrote:
>
> Yes it's valid. No it isn't redirectable.
>
> On Sun, Sep 20, 2026, 18:37 Emelia S. <emelia=
> [e-mail]> wrote:
>
>> Hi all,
>>
>> In the OAuth Extensions Error Registry managed by IANA, invalid_client is
>> listed as having a usage location of "token endpoint, authorization
>> endpoint", citing RFC6749, however, RFC6749's Section 4.1.2.1
>> "Authorization Code Grant -> Authorization Response -> Error Response" does
>> not list invalid_client.
>>
>> https://www.iana.org/assignments/oauth-parameters#extensions-error
>>
>> I'm not sure where the IANA registry contents is from, given that RFC6749
>> does not include the initial registry contents. The only place
>> invalid_client is listed in RFC6749 is on the token endpoint.
>>
>> Can someone clarify if `invalid_client` is valid for the authorization
>> endpoint and if that error is redirectable?
>>
>> — Emelia
>> _______________________________________________
>> OAuth mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
> _______________________________________________
> OAuth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>
>
>