OAuth errorinvalid_request
Mintas could not complete a sign-in between an app and your workspace because the request was missing something or had a value we could not accept. Nothing was shared, and nothing in your account changed.
What it means
Mintas uses OAuth 2.0 when an app connects to your workspace: AI clients such as Claude, ChatGPT or Cursor through the MCP server, the Mintas CLI when you runmintas auth login, and third-party apps built on the API.invalid_request is the standard OAuth error (RFC 6749) for a request that is missing a required parameter, includes a value that is not allowed, or is otherwise malformed. The authorization and token endpoints at api.mintas.co/oauth return it with HTTP status 400, and the error_description says which check failed.
{
"error": "invalid_request",
"error_description": "The request is missing a required parameter",
"error_uri": "https://mintas.co/docs/errors/invalid_request",
"state": "abc123xyz789_secure-random-state-value"
}If you saw this while connecting an app
Start over from the app. Close the tab and connect again from Claude, ChatGPT, your editor or the CLI. Sign-in links and codes expire after a few minutes.
Sign in to Mintas first. Open app.mintas.co, finish two-factor verification, then retry so the consent screen can load.
Remove and re-add the connector. Delete Mintas from the client's connectors or MCP settings, then add
https://api.mintas.co/mcpagain.Use an API key instead. If the client keeps failing, create a key in Settings, Developer and follow the client's setup guide.
Common causes and fixes
For developers building on the Mintas OAuth endpoints. Each row shows a message you may see in error_description.
| Step | Cause | Fix |
|---|---|---|
| Authorize | A required parameter is missing or malformed response_type must be 'code' | Send response_type=code, a client_id, a redirect_uri that is a full URL, a space-separated scope list and a state between 1 and 1,024 characters. |
| Authorize | The redirect URI is not on the allowlist Invalid redirect_uri | Use a redirect_uri that exactly matches one registered for your OAuth application, including scheme, host, path and trailing slash. |
| Authorize | The client_id is unknown or the app is inactive Invalid client_id | Check the client ID in Settings, Developer. If the app was turned off, the owner has to turn it back on. |
| Authorize | A scope the app is not allowed to request Invalid scopes: invoices.write | Request only scopes enabled for the application, such as transactions.read or invoices.read. |
| Authorize | PKCE is missing for a public client PKCE is required for public clients | Send a code_challenge with code_challenge_method=S256, then the matching code_verifier when you exchange the code. |
| Token | The authorization code expired or was already used The authorization code has expired. Please restart the OAuth flow. | Codes last 5 minutes and work once. Reusing a code revokes the tokens issued from it, so start the flow again. |
| Token | The redirect URI changed between steps The redirect_uri does not match the one used in the authorization request. | Send the exact same redirect_uri to the token endpoint that you used to authorize. |
| Token | Client credentials do not fit the client type Public clients must not send client_secret | Public clients (desktop, CLI, MCP) send no secret. Confidential clients must send their client_secret. |
| Token | The refresh token is expired, revoked or wrong Refresh token revoked | Send the person through the authorization flow again to get a new pair of tokens. |
| Token | An unsupported grant type Grant type not supported | Use grant_type=authorization_code or grant_type=refresh_token, as JSON or application/x-www-form-urlencoded. |
Still stuck? Write to us.
Email support@mintas.co and a person will answer. Include the app or client you were connecting, roughly when it happened, and the fullerror_description.
Never send API keys, access tokens, refresh tokens or client secrets. We will never ask for them.