diff --git a/backend/oauth_connect.json b/backend/oauth_connect.json
index 9e74822d98..cec49861cd 100644
--- a/backend/oauth_connect.json
+++ b/backend/oauth_connect.json
@@ -159,7 +159,8 @@
   "sage_intacct": {
     "auth_url": "https://api.intacct.com/ia/api/v1/oauth2/authorize",
     "token_url": "https://api.intacct.com/ia/api/v1/oauth2/token",
-    "scopes": ["offline_access"]
+    "scopes": ["offline_access"],
+    "req_body_auth": true
   },
   "spotify": {
     "auth_url": "https://accounts.spotify.com/authorize",
diff --git a/backend/windmill-oauth/src/lib.rs b/backend/windmill-oauth/src/lib.rs
index 32648a2115..2650b68b4d 100644
--- a/backend/windmill-oauth/src/lib.rs
+++ b/backend/windmill-oauth/src/lib.rs
@@ -1179,6 +1179,18 @@ mod tests {
         assert!(verifier.verify("123", "body", "wrong_sig").is_err());
     }
 
+    // Sage Intacct's token endpoint rejects HTTP Basic client authentication on the
+    // refresh_token grant (`invalid_client`), so its credentials must go in the form body.
+    #[test]
+    fn sage_intacct_registry_entry_uses_request_body_client_auth() {
+        let registry: HashMap<String, OAuthConfig> =
+            serde_json::from_str(include_str!("../../oauth_connect.json")).unwrap();
+        assert_eq!(
+            registry.get("sage_intacct").unwrap().req_body_auth,
+            Some(true)
+        );
+    }
+
     #[test]
     fn canonical_provider_name_strips_sandbox_suffix() {
         assert_eq!(canonical_provider_name("docusign_sandbox"), "docusign");