<p>I have KeyCloak Gateway running successfully locally providing Google OIDC authentication for the Kubernetes dashboard. However using the same settings results in an error when the app is deployed as a pod in the cluster itself.</p>

<p>The error I see when the Gateway is running in a K8S pod is:</p>

<pre><code>unable to exchange code for access token    {"error": "invalid_request: Credentials in post body and basic Authorization header do not match"}
</code></pre>

<p>I'm calling the gateway with the following options:</p>

<pre><code>--enable-logging=true
--enable-self-signed-tls=true
--listen=:443
--upstream-url=https://mydashboard
--discovery-url=https://accounts.google.com
--client-id=&lt;client id goes here&gt;
--client-secret=&lt;secret goes here&gt;
--resources=uri=/*
</code></pre>

<p>With these settings applied to a container in a pod I can browse to the Gateway, am redirected to Google to log in, and then am redirected back to the Gateway where the error above is generated.</p>

<p>What could account for the difference between running the application locally and running it in a pod that would generate the above error?</p>

Phyxx
<p>This turned out to be a copy/paste fail in the end, with the client secret being incorrect. The error message wasn't much help here, but at least it was a simple fix.</p>
