Authorization code

curl -s -X POST https://<OKTA_DOMAIN>/oauth2/v1/token \
       -d "grant_type=authorization_code" \
       -d "code=invalid-test" \
       -d "client_id=<CLIENT_ID>" \
       -d "client_secret=<CLIENT_SECRET>" \
       -d "redirect_uri=https://placeholder/callback" | jq

invalid_grant is a valid response

 "error": "unauthorized_client",
 "error_description": "The client is not authorized to use the provided grant type. Configured grant types: [authorization_code]."

See also

• grant_types: authorization_code, client_credentials, refresh_token
• IdP <-> RP, client_id, client_secret, Issuer URL, QUARKUS_OIDC_CLIENT_ID, .well-known/openid-configuration, grant_type
• redirect_uri, Keycloak OIDC