## Expected Behavior: **I provide the following REQUIRED claim values in a JSON Web Token:** iss sub aud jti exp iat (A quick question here, is there a value that I should be using for my jti, I'm using session_id for now) **Then also include the following values in the JWT as well:** grant_type code client_id client_secret **I send a ‘POST’ body to my token endpoint that looks like this:** ``` headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'content-length': 579 }, body: 'grant_type=authorization_code&assertion=<token-here> ``` **I retrieve an access code and use to authenticate my user** ## Actual Behavior: My post request returns the following error in the response's body: `{"error":"invalid_client","error_description":"Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the Authorization request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code, and include the WWW-Authenticate response header field matching the authentication scheme used by the client."}` ## Code Samples/Configuration Options ``` jwt.sign(payload, process.env.SECRET, signOptions, (err, token) => { if (err) { console.log(err); } request.post({ headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, 'url': 'https://<auth-server-url.com>/oxauth/restv1/token', 'body': `grant_type=authorization_code&assertion=${token}` }, (error, response, body) => { if (error) { console.log(error); } else { console.log(response); console.log(body); } }) }); ``` Gluu Client configurations: Scopes: openid, profile. email Response Types: code Grant Types: refresh_token, authorization_code authentication method for the token endpoint: client_secret_jwt Encryption/Signing settings: HS256 If I can get all of this working I'll happily share a gist with the team. ## Notes I am successfully passing a JWT when redirecting users to my authorization endpoint. Thanks, Morgan