Migration to 1.20+
Keycloak changes to the client authentication using basic authentication
Starting with MACMA version 1.20, Keycloak started applying url-decoding to the client-id and client-secret for client authentication using basic authentication. This means that clients that have ids or secrets containing any of the following characters: % or + will fail to get tokens (401 Unauthorized will be returned, and the response body will contain "invalid client credentials"). In this case appropriate actions need to be taken to change the client-id or client-secret to a valid value.