# Invalid\_grant error while using Password Flow

**URL:** <https://community.auth0.com/t/invalid-grant-error-while-using-password-flow/85594>\
**Category:** Get Help\
**Tags:** login, auth0\
**Created:** [June 21, 2022, 1:33am UTC](https://community.auth0.com/t/invalid-grant-error-while-using-password-flow/85594 "2022-06-21T01:33:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![axel1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/axel1/32/38268_2.png) [@axel1](https://community.auth0.com/u/axel1)\
**Post date:** [June 21, 2022, 1:33am UTC](https://community.auth0.com/t/invalid-grant-error-while-using-password-flow/85594/1 "2022-06-21T01:33:32Z")

</div>

Hi,

I need some help in figuring out what is that I am doing wrong here.

### TL; DR:

I am trying to implement [Cypress.io](http://Cypress.io) tests on my exising codebase.  
Unfortunately, I keep getting this as a response when executing the code from that [Cypress.io](http://Cypress.io) guide:

```auto
{
  "error": "invalid_grant",
  "error_description": "Wrong email or password."
}

```

I am trying to follow their docs: [Auth0 Integration: Cypress Guide | Cypress Documentation](https://docs.cypress.io/guides/end-to-end-testing/auth0-authentication#Auth0-Application-Setup)

## The setup:

- My App’s Application Type is: “Single Page Application”  

- Grant Types for my app includes “password” (checkbox is checked)  

- Default audience for the tenant is set. **AND** Default directory set to “Username-Password-Authentication”  

- I created a “cypress” user from Auth0’s dashboard  

- I successfully logged in via the test on the Database Connections section.  

## Executing the code from the Cypress guide:

I can see that the request (among other data) looks like this:

```auto
Method: POST
URL: <my auth0 domain>/oauth/token

```

```javascript
Body: {
    "grant_type": "password",
    "username": " *******", // <-- triple checked this is correct
    "password": " *******", // <-- triple checked this is correct
    "audience": " *******",
    "scope": "openid profile email",
    "client_id": " *******",
    "client_secret": " *******"
}

```

## The code:

```auto
// cypress/support/commands.js
Cypress.Commands.add(
  'loginByAuth0Api',
  (username: string, password: string) => {
    cy.log(`Logging in as ${username}`)

    /**
       The following constants are being properly picked up.
        All the values are printed in the request from before.
        
        They also match my tenant/app settings.
    **/
    const client_id = Cypress.env('auth0_client_id')
    const client_secret = Cypress.env('auth0_client_secret')
    const audience = Cypress.env('auth0_audience')
    const scope = Cypress.env('auth0_scope')

    cy.request({
      method: 'POST',
      url: `https://${Cypress.env('auth0_domain')}/oauth/token`,
      body: {
        grant_type: 'password',
        username,
        password,
        audience,
        scope,
        client_id,
        client_secret,
      },
    }).then(({ body }) => {
      const claims = jwt.decode(body.id_token)
      const {
        nickname,
        name,
        picture,
        updated_at,
        email,
        email_verified,
        sub,
        exp,
      } = claims

      const item = {
        body: {
          ...body,
          decodedToken: {
            claims,
            user: {
              nickname,
              name,
              picture,
              updated_at,
              email,
              email_verified,
              sub,
            },
            audience,
            client_id,
          },
        },
        expiresAt: exp,
      }

      window.localStorage.setItem('auth0Cypress', JSON.stringify(item))

      cy.visit('/')
    })
  }
)

```

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [June 24, 2022, 6:46pm UTC](https://community.auth0.com/t/invalid-grant-error-while-using-password-flow/85594/3 "2022-06-24T18:46:47Z")

</div>

Hi @axel1,

Welcome to the Auth0 Community!

You should not be passing the `client_secret` param when the app is registered as a Single Page Application.

Can you try the request without that param and see if that fixes it?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [May 11, 2023, 12:57pm UTC](https://community.auth0.com/t/invalid-grant-error-while-using-password-flow/85594/4 "2023-05-11T12:57:23Z")

</div>