# invalid_client

> The client wasn't accepted

- Status: 401 Unauthorized
- Returned by: The account connection (/oauth)
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- The account connection
- Page in the portal: https://developers.rivr.io/errors/invalid_client
- Try it: `GET https://developers.rivr.io/errors/simulate/invalid_client` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`

## What it means

`POST /oauth/token` and `POST /oauth/deauthorize` answer the same code for an unknown `client_id`, an inactive client and a wrong secret. `GET /oauth/authorize` shows the code on Rivr's error page, also for a client that doesn't belong to a platform, carries scopes outside `public:*` or whose platform has users of its own in Rivr's platform portal. The sandbox's approval answers `401` with `{"code":"invalid_client"}`. `grant_type: merchant_token` on `/connect/token` also answers `401` with this code, among other things when the clinic isn't connected to your platform. An organisation key's token endpoint answers the same code for a wrong `client_id` or `client_secret`.

## What your system does

Check `client_id` and `client_secret`, for example after a rotation. On `merchant_token` the code doesn't on its own mean the clinic is disconnected: fetch a platform token and read `GET /api/public/merchants/{merchantId}`. `404` means disconnected. If the platform token can't be fetched it is your keys that are wrong. If the error page shows the code, contact Rivr about how the client is set up.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

A wrong secret doesn't burn the code: the same code can be redeemed with the right secret within five minutes.

## Example: The account connection (/oauth)

```http
HTTP/1.1 401 Unauthorized
Content-Type: application/json
Cache-Control: no-store

{
  "error": "invalid_client",
  "error_description": "client_id or client_secret is invalid."
}
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.