.NET SDK returning 400 for Client Credentials grant despite valid scopes

I’m setting up a background service in C# to pull historical analytics data. It’s purely server-side, no human interaction. The docs say Client Credentials is the way to go for this.

Here is the code I’m using with the GenesysCloudPlatformClient SDK:

var config = new Configuration
{
 ApiKey = new Dictionary<string, string>
 {
 { "authorization", "" } // Left empty as per docs for client creds
 },
 ApiKeyPrefix = new Dictionary<string, string>
 {
 { "authorization", "" }
 }
};

var authApi = new AuthApi(config);
var tokenResponse = await authApi.PostOAuthTokenAsync(
 grantType: "client_credentials",
 clientId: "my-client-id",
 clientSecret: "my-secret",
 scope: "analytics:report:read"
);

The response comes back with a 400 Bad Request. The error body is just:

{
 "errors": [
 {
 "message": "Invalid grant type"
 }
 ]
}

I’ve double checked the client ID and secret. They work fine in Postman when I send a raw POST to /v2/oauth/token. I can even get a token for analytics:report:read manually. But the SDK method PostOAuthTokenAsync seems to choke on it.

Is the .NET SDK expecting a different parameter structure for client credentials? Or do I need to manually construct the HttpClient request instead of using the generated AuthApi? The documentation for the SDK is pretty thin on this specific error case.

You’re leaving the ApiKey dictionary empty, which is likely causing the SDK to skip the token generation step entirely. The Genesys Cloud .NET SDK handles the Client Credentials flow internally if you pass the credentials correctly. You don’t need to manually set the authorization header to an empty string.

Try initializing the Configuration with the ClientId and ClientSecret directly. The SDK will fetch the token automatically when you make the first API call.

var config = new Configuration
{
 ClientId = "your_client_id",
 ClientSecret = "your_client_secret",
 BaseUrl = "https://api.mypurecloud.com"
};

var platformClient = PlatformClientFactory.CreateWithConfiguration(config);

Make sure your client has the analytics:report:view scope. If you still get a 400, check the Exception object for the specific error message from the token endpoint. It usually tells you exactly what’s wrong with the grant type.