title: OAuth {"error":"invalid_client"} grant type "client credential" - C# ASP.Net Web API
body: <p>I keep getting invalid client while trying to request a token from my local endpoint using postman or curl. It is just a ASP.NET MVC project with WebAPI enabled (the check box when you create the project).I have got one class MyAuthorizationServerProvider.cs which has got the below code</p>
  <pre><code>using System;
  using System.Configuration;
  using System.Security.Claims;
  using System.Threading.Tasks;
  using Microsoft.Owin.Security.OAuth;
  
  namespace OAuth2App.Provider
  {
      public class OAuthProvider : OAuthAuthorizationServerProvider
      {
          public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
          {
              string clientId;
              string clientSecret;
              Guid clientIdGuid;
              if (!context.TryGetBasicCredentials(out clientId, out clientSecret))
              {
                  context.TryGetFormCredentials(out clientId, out clientSecret);
              }
              if (null == context.ClientId || null == clientSecret || !Guid.TryParse(clientId, out clientIdGuid))
              {
                  context.SetError(&quot;invalid_credentials&quot;, &quot;A valid client_Id and client_Secret must be provided.&quot;);
                  context.Rejected();
                  return;
              }
              //validate aginstdb or config: GetClient(clientIdGuid, clientSecret);  
              bool isValidClient = ConfigurationManager.AppSettings[&quot;ClientId&quot;] == clientId &amp;&amp; ConfigurationManager.AppSettings[&quot;ClientSecret&quot;] == clientSecret;
              if (!isValidClient)
              {
                  context.SetError(&quot;invalid_credentials&quot;, &quot;A valid client_Id and client_Secret must be provided.&quot;);
                  context.Rejected();
                  return;
              }
              await Task.Run(() =&gt; context.Validated(clientId));
          }
          public override async Task GrantClientCredentials(OAuthGrantClientCredentialsContext context)
          {
              Guid clientId;
              Guid.TryParse(context.ClientId, out clientId);
              //validate aginstdb or config: GetByClientId(clientId);  
              bool client = ConfigurationManager.AppSettings[&quot;ClientId&quot;] == clientId.ToString().ToUpper();
              if (!client)
              {
                  context.SetError(&quot;invalid_grant&quot;, &quot;Invaild client.&quot;);
                  context.Rejected();
                  return;
              }
              var claimsIdentity = new ClaimsIdentity(context.Options.AuthenticationType);
              claimsIdentity.AddClaim(new Claim(&quot;LoggedOn&quot;, DateTime.Now.ToString()));
              await Task.Run(() =&gt; context.Validated(claimsIdentity));
          }
          public override Task TokenEndpoint(OAuthTokenEndpointContext context)
          {
              if (context.TokenIssued)
              {
                  context.Properties.ExpiresUtc = DateTimeOffset.UtcNow.AddSeconds(3600);
              }
              return Task.FromResult&lt;object&gt;(null);
          }
      }
  }
  </code></pre>
  <p>I have got another OWIN startup class as below</p>
  <pre><code>using Microsoft.Owin;
  using Microsoft.Owin.Security.OAuth;
  using OAuth2App.Provider;
  using Owin;
  using System;
  [assembly: OwinStartup(typeof(OAuth2App.Startup))]
  namespace OAuth2App
  {
      public class Startup
      {
          public void Configuration(IAppBuilder app)
          {
              ConfigureAuth(app);
          }
          public void ConfigureAuth(IAppBuilder app)
          {
              var oAuthOptions = new OAuthAuthorizationServerOptions {
                  AllowInsecureHttp = true, // need set to false in PROD  
                      TokenEndpointPath = new PathString(&quot;/oauth2/token&quot;),
                      AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(60), //token expiration time  
                      Provider = new OAuthProvider(),
              };            
              app.UseOAuthAuthorizationServer(oAuthOptions);
              app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
          }
      }
  }
  </code></pre>
  <p>My web.config app settimgs section is as below</p>
  <pre><code>&lt;appSettings&gt;
      &lt;add key=&quot;webpages:Version&quot; value=&quot;3.0.0.0&quot; /&gt;
      &lt;add key=&quot;webpages:Enabled&quot; value=&quot;false&quot; /&gt;
      &lt;add key=&quot;ClientValidationEnabled&quot; value=&quot;true&quot; /&gt;
      &lt;add key=&quot;clientId&quot; value=&quot;XXXXXXXXXXXXXXXXXXXXXX&quot; /&gt;
      &lt;add key=&quot;clientSecret&quot; value=&quot;XXXXXXXXXXXXXXXXXXXXXXXXX&quot; /&gt;
      &lt;add key=&quot;UnobtrusiveJavaScriptEnabled&quot; value=&quot;true&quot; /&gt;
    &lt;/appSettings&gt;
  </code></pre>
  <p>When I try to fire a post request, the below is what I get in postman. While debugging, I see that the context object always has the clientID field as null. Can someone please point out what I ding wrong ?</p>
  <pre><code>public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
  </code></pre>
  <p><a href="https://i.stack.imgur.com/bAX4A.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bAX4A.png" alt="PostmanCall" /></a></p>