# X_AUTH_CONSENT_INVALID

## Means

a consent was approved for a request the authorization server refuses

## Typical cause

approve() or deny() was handed a request readRequest(url) would refuse — an unknown client, an unregistered redirect, a scope the client never asked for

## Fix

`server.readRequest(url)   # on the consent page: render its refusal, approve only what it returned`

[Auth and sessions](/error-codes#auth-and-sessions)