# Keycloak: invalid_grant — Account is not fully set up

**Code:** `Account is not fully set up` · **Category:** Authentication · **Seen on:** REST API

The user has pending required actions (verify email, update password, configure OTP), so non-interactive token requests (password grant) fail.

## Meaning

Required actions can only be completed in the browser login flow. Clear them for service/test users or log in interactively once.

## Common causes

- Required actions on the user (Verify Email, Update Password, Configure OTP)
- Password grant used for a user with pending actions
- Temporary password set by an admin

## Quick fix

1. Remove required actions in the admin console (Users → Details)
2. Set non-temporary passwords for test/service users
3. Use the browser flow to complete actions

## Detailed fix by platform

### Shell

1. 

```bash
# kcadm
/opt/keycloak/bin/kcadm.sh update users/$USER_ID -r myrealm -s 'requiredActions=[]'
```


## How to diagnose

1. **User** — Required actions list
2. **Password** — Temporary?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/auth/keycloak-account-not-fully-set-up)