Keycloak: invalid_grant — Account is not fully set up
The user has pending required actions (verify email, update password, configure OTP), so non-interactive token requests (password grant) fail.
Exact message you may see
Account is not fully set upinvalid_grant Account is not fully set up
Seen on:
REST API
Meaning
Required actions can only be completed in the browser login flow. Clear them for service/test users or log in interactively once.
Common causes
- Required actions on the user (Verify Email, Update Password, Configure OTP)
- Password grant used for a user with pending actions
- Temporary password set by an admin
⚡ Quick fix
- Remove required actions in the admin console (Users → Details)
- Set non-temporary passwords for test/service users
- Use the browser flow to complete actions
Detailed fix by platform
Shell
- bash
# kcadm /opt/keycloak/bin/kcadm.sh update users/$USER_ID -r myrealm -s 'requiredActions=[]'
How to diagnose
- User — Required actions list
- Password — Temporary?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in Authentication
Other ways to find it
Where this error sits
Origin: Application & API. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Did this fix work for you?
Report a correction or suggest an improvement
Last updated 13 Oct 2026