Firebase OIDC + Keycloak: `INVALID_IDP_RESPONSE` error (`invalid_grant`, code not valid

I'm integrating Firebase Authentication with Keycloak as an OpenID Connect (OIDC) provider in an Angular application.

During the sign-in process, I receive the following error after redirection from the Keycloak login page:

INVALID_IDP_RESPONSE : Error getting access token from [Keycloak issuer URL],
OAuth2 redirect uri is: [firebase-app].firebaseapp.com/__/auth/handler,
response: OAuth2TokenResponse{params: error=invalid_grant&error_description=Code%20not%20valid, ...}

✅ Setup details:

• 
  Firebase OIDC provider configured with:
  
  • Issuer: https://<your-domain>/realms/<realm>
  • Client ID and Client Secret (from Keycloak)
  • Redirect URI: https://<firebase-app>.firebaseapp.com/__/auth/handler
• 
  Keycloak client configuration:
  
  • Access Type: confidential
  • Auth Method: Client ID and Secret
  • Valid Redirect URIs includes the Firebase one
  • OpenID Connect settings mostly default
  • Token endpoint: https://<your-domain>/realms/<realm>/protocol/openid-connect/token
• 
  The client is not using client_secret_post explicitly, but I can't control how Firebase performs the token exchange.
  

In the Angular frontend, I use Firebase Authentication’s signInWithRedirect to start the login flow, and inside the login component’s ngOnInit, I handle the redirect result with getRedirectResult, and when there is the redirect I have an object like this: {user: null, credential: null}.

❓ What I'm looking for:

• Any ideas why Firebase may be getting an invalid_grant response from Keycloak?
• Could it be related to redirect URIs, session expiration, code re-use, or token endpoint auth method?
• Is there something specific in Keycloak that needs to be configured for Firebase to complete the OIDC flow?

Environment:

• Firebase (custom OIDC provider)
• Keycloak (recent self-hosted version)
• Angular frontend with @angular/fire for authentication

Thanks in advance for any help or experience shared!

Continue reading...