# OAuth 2.0 error code: invalid_request

Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade.

This is the markdown version of https://openbrokerapi.com/errors/oauth/invalid-request, written from the same records as that page.

Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.

As text you can copy:

```
invalid_request
```

- Kind: Error code
- Where you meet it: In the error field of a reply, or in the WWW-Authenticate header
- Read from: [RFC 6749, The OAuth 2.0 Authorization Framework, section 5.2](https://www.rfc-editor.org/rfc/rfc6749.html#section-5.2)
- Status: verified. Source: [rfc-editor.org](https://www.rfc-editor.org/rfc/rfc6749.html#section-5.2), checked 2026-10-09.

## What does invalid_request mean in OAuth 2.0?

The request to the token endpoint is malformed: it is missing a required parameter, includes an unsupported parameter value other than the grant type, repeats a parameter, includes more than one credential or uses more than one way of authenticating the client. The authorisation server answers with HTTP 400 unless stated otherwise.

## What it means in trading API work

You meet it while obtaining or refreshing a token for a trading API that uses OAuth 2.0. The request for the token is wrongly built, so no token is issued.

This part is this site's own explanation, written for people learning to call a trading API. It is not part of the source cited above and it describes no particular broker.

## What should I do about invalid_request?

Compare the token request with the API's documentation, parameter by parameter: the names, the spelling, the content type of the body, and that each parameter appears once.

This page is an independent explanation in plain words. The definition itself is in [the source it was read from](https://www.rfc-editor.org/rfc/rfc6749.html#section-5.2), which is the authority if the two ever differ.

## Where to go next

- [Everything decoded for OAuth 2.0](https://openbrokerapi.com/errors/oauth)
- [Getting started with API trading](https://openbrokerapi.com/guides/getting-started-with-api-trading): What an API is, what you need and how to make a first call safely.
- [Brokers](https://openbrokerapi.com/brokers): The record for each broker: access, limits, endpoints and error codes.
- [Platform APIs](https://openbrokerapi.com/platforms): APIs that belong to trading software offered by many brokers.
- [Error codes](https://openbrokerapi.com/errors): What each error means, and the fix where the source gives one.

## Licence and how to cite

The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page.

Cite as: OAuth 2.0 error code: invalid_request. Broker API Hub, https://openbrokerapi.com/errors/oauth/invalid-request, newest check 2026-10-09.

Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.