Creating a new client via Dynamic Client Registration endpoint using IAT fails to decode the token #41327

matgnt · 2025-07-22T12:25:22Z

matgnt
Jul 22, 2025

When I use the IAT as described here:
https://www.keycloak.org/securing-apps/client-registration#_initial_access_token

I get this error message:

b'{"error":"invalid_token","error_description":"Failed decode token"}'

When I remove the bearer part, it works, BUT it seems to follow the 'anonymous access' flow because I get an error:

b'{"error":"insufficient_scope","error_description":"Policy \'Trusted Hosts\' rejected request to client-registration service. Details: Host not trusted."}'

When I remove the Authorization header it is exactly the same message.

Anonymous DCR is not what I need, which means I'm back at the initial error of Failed decode token.
I've got the token from my freshly started keycloak where I created such an IAT in the according menu.

Any thoughts, what could go wrong?

I'm using version 26.3.0 but tested also other random versions back to 21.0.

I'm using start-dev command line to startup KC. I hope this doesn't have any impact on this endpoint's behavior.

Thanks for any hint,
Matthias

Navigation Menu

Repository navigation

Creating a new client via Dynamic Client Registration endpoint using IAT fails to decode the token #41327

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Creating a new client via Dynamic Client Registration endpoint using IAT fails to decode the token #41327

Uh oh!

matgnt Jul 22, 2025

Replies: 0 comments

matgnt
Jul 22, 2025