What causes "License does not allow OIDC PKCE method support" in Budibase/budibase?

Remove the pkce field (or set it false) from the OIDC config entries

License does not allow OIDC PKCE method support

Error message

License does not allow OIDC PKCE method support

What it means

processOIDCConfig validates the OIDC config on save. If any OIDC config entry sets pkce but the tenant license does not include the PKCE-for-OIDC feature (pro.features.isPkceOidcEnabled()), the save fails. PKCE is a paid/license-gated capability.

Source

Thrown at packages/worker/src/api/controllers/global/configs.ts:247

}

async function processGoogleConfig(
  config: GoogleInnerConfig,
  existing?: GoogleInnerConfig
) {
  await verifySSOConfig(ConfigType.GOOGLE, config)

  if (existing && config.clientSecret === PASSWORD_REPLACEMENT) {
    config.clientSecret = existing.clientSecret
  }
}

async function processOIDCConfig(config: OIDCConfigs, existing?: OIDCConfigs) {
  await verifySSOConfig(ConfigType.OIDC, config.configs[0])

  const anyPkceSettings = config.configs.find(cfg => cfg.pkce)
  if (anyPkceSettings && !(await pro.features.isPkceOidcEnabled())) {
    throw new Error("License does not allow OIDC PKCE method support")
  }

  config.configs.filter(c => c.pkce === null).forEach(c => delete c.pkce)

  if (existing) {
    for (const c of config.configs) {
      const existingConfig = existing.configs.find(e => e.uuid === c.uuid)
      if (!existingConfig) {
        continue
      }
      if (c.clientSecret === PASSWORD_REPLACEMENT) {
        c.clientSecret = existingConfig.clientSecret
      }
    }
  }
}

export async function processRecaptchaConfig(

View on GitHub (pinned to a81a902e9a)

Solutions

Remove the pkce field (or set it false) from the OIDC config entries
Upgrade the license to a plan that includes OIDC PKCE support
Re-sync/refresh the license key so entitlements update
Confirm which config entry carries pkce via the API and strip it server-side before save

Example fix

// before
{ "configs": [{ "clientId": "x", "pkce": true }] }
// after
{ "configs": [{ "clientId": "x" }] } // or upgrade license for pkce: true

Defensive patterns

Strategy: validation

Validate before calling

import { features } from "@budibase/pro"
// client-side equivalent: check entitlements from the org/license info endpoint
const pkceAllowed = await pro.features.isPkceOidcEnabled()
const payload = configs.map(c => pkceAllowed ? c : { ...c, pkce: undefined })

Try / catch

try {
  await configApi.save(oidcConfig)
} catch (err) {
  if (err.message.includes("OIDC PKCE")) {
    // strip pkce and retry, or prompt for license upgrade
  } else { throw err }
}

Prevention

Hide PKCE options in UI when the entitlement is absent
Fetch feature entitlements before rendering license-gated settings
Strip license-gated fields from copied config templates
Verify license validity before editing premium auth settings

When it happens

Trigger: Saving an OIDC config where any entry in config.configs has pkce set truthy while the license lacks the OIDC PKCE feature.

Common situations: Users on free/lower-tier licenses copying a config template that includes pkce:true, or UI exposing a PKCE toggle that should be hidden by entitlement; license key not upgraded or not refreshed.

Related errors

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/e9cf26dce4f46bda. Report an issue: GitHub.