Invalid user credentials when login by password, If turn OTP to Alternative

Getting advice
1

I want to retrieve access token via api where I provide password or opt (from GG Authenticator).

How to get access token via API POST https://{mydomain}/realms/Resource/protocol/openid-connect/token by password or opt (FE will provide appropriate the param depend on user chose).

I already config the direct grant flow like below on keycloak version 23.0.4

1277×913 28.4 KB

More detail, api returns 401 when I add OTP step and set it to Alternative. If I disable OTP, it returns 200
1217×714 42 KB

I implemented almost the same way for Browser authen flow and it worked. But Direct grant is not.

Thank you!