The OAuth token endpoint responds with a 400 - Bad Request status code and provides the appropriate descriptions when it encounters invalid or missing information submitted as part of your POST request.
Listed below are some of the common descriptions that represent failures in retrieving the access token.
400-Bad Request:
Incorrect or missing scope
access_denied: Admin policy denied access.
Incorrect clientId
invalid_client: Invalid client_id {clientid}.
Incorrect clientId
invalid_client: Required parameter (client_id) is missing.
Incorrect secret
invalid_client: Client authentication (client secret) failed.
Invalid grant_type
invalid_request: Unsupported value for field (grant_type).
Missing grant type
invalid_request: Required parameters (grant_type) is missing.