Invalid status code received from the token endpoint” means Kong tried to exchange an authorization code for a token, but the PingFederate token endpoint replied with an error

302 Found:

• Kong redirects the client to the authorization endpoint of PingFederate.
• This is normal behavior during the initial OIDC flow (when no token is present).

401 Unauthorized (after redirect):

• The client is redirected back to Kong with an authorization code.
• Then Kong calls the token endpoint to exchange code → tokens.
• But this step fails (e.g., bad client credentials, redirect URI mismatch, wrong token endpoint).
• Result: 401 Unauthorized, often shown to the user after the browser returns from the IdP.

A 400 Bad Request from the OpenID Connect token endpoint usually means something is wrong with the request payload you’re sending. This often happens during a token exchange or authorization code flow.

Let’s troubleshoot it step by step:

🔍 Common Causes of 400 from Token Endpoint

1. Invalid or missing parameters
   • Missing grant_type, client_id, client_secret, code, or redirect_uri
   • Using wrong grant_type (e.g., should be authorization_code, client_credentials, refresh_token, etc.)
2. Mismatched or invalid redirect URI
   • Must match the URI registered with the provider exactly.
3. Invalid authorization code
   • Expired or already used.
4. Invalid client credentials
   • Bad client_id / client_secret
5. Wrong Content-Type
   • The request should be: bashCopyEditContent-Type: application/x-www-form-urlencoded

To know why Ping returned 400, you need to:

1. Check PingFederate logs – often shows detailed error like:

Invalid redirect_uri
Invalid client credentials
Unsupported grant_type

Kong is probably misconfigured or failing to capture the code from the redirect step before trying the token exchange.

This usually happens due to:

• Misconfigured redirect_uri
• Missing or misrouted callback handling (/callback)
• Client app hitting the wrong route first
• Kong OIDC plugin misconfigured (missing session_secret, or improper auth_methods)

Troubleshooting