# Grant type not allowed
## The error
`/oauth/token` returns `403` with `{"error": "unauthorized_client", "error_description": "Grant type 'X' not allowed for the client."}`
## Why it happens
Every application has an allowlist of grant types, derived from its type. Defaults from Auth0's docs:
- Public apps (SPA, native): implicit, authorization_code, refresh_token. Native can also use the device code grant.
- Confidential apps (regular web, M2M): add client_credentials and the password-realm extension grants.
- Public apps can NEVER use client_credentials. That is by design, not a toggle.
## Fix
1. Dashboard > Applications > your app > Settings > Show Advanced Settings > Grant Types. Tick the grant you need.
2. If the grant you need is unavailable for the type (e.g. client_credentials on an SPA), the application TYPE is wrong. Change the type or create a new app of the right type. Do not try to force it.
3. To make a public app confidential (so it can use client_credentials), set token endpoint auth to client_secret_post, client_secret_basic, or private_key_jwt via the Management API Update Client endpoint. But if the app is really a browser app, it should stay public and you should use the authorization code flow instead.
## Common cases
- M2M script using authorization_code: wrong, M2M apps use client_credentials only.
- SPA backend trying client_credentials with the SPA's client id: create a separate M2M application for the backend.
- `password` grant on a new app: disabled by default; enable it explicitly, or better, stop using the password grant.
## Checklist
- The grant in the request is ticked on the application.
- Public vs confidential matches where the code runs.