# /oauth/token grant\_type password login "access\_denied" with "Unauthorized"

**URL:** <https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818>\
**Category:** Get Help\
**Tags:** application, free-trial\
**Created:** [September 12, 2025, 4:27am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818 "2025-09-12T04:27:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![yehtetlwin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yehtetlwin/32/75313_2.png) [@yehtetlwin](https://community.auth0.com/u/yehtetlwin)\
**Post date:** [September 12, 2025, 4:27am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818/1 "2025-09-12T04:27:21Z")

</div>

I am trying to call grant\_type: password token request in Postman and I am getting the following response.

```json
{
    "error": "access_denied",
    "error_description": "Unauthorized"
}

```

**My request**

method: POST

```c
curl --location 'https://<tenant-url>.auth0.com/oauth/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=<username>' \
--data-urlencode 'password=<password>' \
--data-urlencode 'scope=email' \
--data-urlencode 'client_id=<client-id>' \
--data-urlencode 'client_secret=<client-secret>'

```

**Application Settings**

- Application Type: Regular Web Application

- Advanced Settings \> Grant Types: ✅ Implicit ✅ Authorization Code ✅Refresh Token ✅ Client Credentials ✅ Password

- Authentication Method: Client Secret (Post)

- Connection: Username-Password-Authentication

**Things I double checked**

- Tenant URL

- Username & Password (checked with Connection Test)

- Client ID

- Client Secret

Please kindly tell me what is wrong.

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [September 12, 2025, 7:28am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818/3 "2025-09-12T07:28:14Z")

</div>

Hi @yehtetlwin and welcome to the Auth0 Community!

Could you please confirm that going into Applications - Application - Connections tab, the Username-Password-Authentication connection is toggled on? I’m asking because a common cause for this error is that the Application doesn’t have access to the database.

Thanks!  
Teodor.

---

<div class="post-metadata">

**Author:** ![yehtetlwin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yehtetlwin/32/75313_2.png) [@yehtetlwin](https://community.auth0.com/u/yehtetlwin)\
**Post date:** [September 12, 2025, 8:35am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818/4 "2025-09-12T08:35:18Z")

</div>

Yes, Username-Password-Authentication connection is toggled on in Application \> Connection tab.

---

<div class="post-metadata">

**Author:** ![yehtetlwin](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yehtetlwin/32/75313_2.png) [@yehtetlwin](https://community.auth0.com/u/yehtetlwin)\
**Post date:** [September 12, 2025, 8:49am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818/5 "2025-09-12T08:49:29Z")

</div>

With futher research

I finally can access token by Basic Authorization with Client ID and Client Secret in Header’s “Authorization” and other params as a form of URL Params.

```javascript
    const credentials = Buffer.from('<client-id>:<client-secret>').toString(
      'base64'
    )
    const res = await fetch('https://<tenant-url>.auth0.com/oauth/token/', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${credentials}`,
      },
      body: new URLSearchParams({
        grant_type: 'password',
        username: '<username>',
        password: '<password>',
        scope: 'email',
      }),
    })

```

But I cannot find any tutorial that mentions to use Client ID and Client Secret as Basic Authorization in Header, so I doubt it is a correct way to do it. 🤔

Can you please confirm it?

---

<div class="post-metadata">

**Author:** ![teodor.andrei](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/teodor.andrei/32/75320_2.png) [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\
**Post date:** [September 12, 2025, 9:11am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818/6 "2025-09-12T09:11:38Z")

</div>

Hi again @yehtetlwin!

Yes, using the `Authorization` header with HTTP Basic authentication is a **correct, standard, and often recommended** way for a **confidential client** to authenticate itself when calling the `/oauth/token` endpoint.  
The reason you may not see this method in every tutorial is that some examples simplify the request by putting the `client_id` and `client_secret` directly in the request body. Both methods are supported by the OAuth 2.0 specification, but using the `Authorization` header is generally considered a cleaner and better practice.

Your method is perfectly valid according to the OAuth 2.0 specification ([RFC 6749, Section 2.3.1](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1:~:text=request.%0A%0A2.3.1.-,Client%20Password,-Clients%20in%20possession)), which defines client authentication for confidential clients.

I wish you a great day!  
Teodor.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 26, 2025, 9:12am UTC](https://community.auth0.com/t/oauth-token-grant-type-password-login-access-denied-with-unauthorized/191818/7 "2025-09-26T09:12:23Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.