PrefectHQ/fastmcp · error · ValueError

Cannot specify 'algorithm' when providing a custom token_ver

Error message

Cannot specify 'algorithm' when providing a custom token_verifier. Configure the algorithm on your token verifier instead.

What it means

When a custom token_verifier is supplied, OIDCProxy forbids also passing 'algorithm' because the verifier owns token-validation settings; the two would conflict. The message tells you to configure the algorithm on the verifier itself. (Similarly required_scopes is disallowed in the same block.)

Source

Thrown at fastmcp_slim/fastmcp/server/auth/oidc_proxy.py:368

            raise ValueError("Missing required config URL")

        if not client_id:
            raise ValueError("Missing required client id")

        if not client_secret and not jwt_signing_key:
            raise ValueError(
                "Either client_secret or jwt_signing_key must be provided. "
                "jwt_signing_key is required when client_secret is omitted "
                "(e.g., for PKCE public clients)."
            )

        if not base_url:
            raise ValueError("Missing required base URL")

        # Validate that verifier-specific parameters are not used with custom verifier
        if token_verifier is not None:
            if algorithm is not None:
                raise ValueError(
                    "Cannot specify 'algorithm' when providing a custom token_verifier. "
                    "Configure the algorithm on your token verifier instead."
                )
            if required_scopes is not None:
                raise ValueError(
                    "Cannot specify 'required_scopes' when providing a custom token_verifier. "
                    "Configure required scopes on your token verifier instead."
                )

        if isinstance(config_url, str):
            config_url = AnyHttpUrl(config_url)

        self.oidc_config = self.get_oidc_configuration(
            config_url, strict, timeout_seconds
        )
        if (
            not self.oidc_config.authorization_endpoint
            or not self.oidc_config.token_endpoint

View on GitHub (pinned to 1f02114297)

Solutions

1. Remove the algorithm argument from OIDCProxy and set it on your custom token_verifier instead
2. Also remove required_scopes if you pass a custom verifier (same restriction)
3. Only pass algorithm when relying on the built-in JWT verification (no custom token_verifier)

Example fix

// before
proxy = OIDCProxy(..., token_verifier=my_verifier, algorithm="RS256")
// after
verifier = MyVerifier(algorithm="RS256")
proxy = OIDCProxy(..., token_verifier=verifier)

if token_verifier is not None:
    assert algorithm is None, "configure algorithm on the token_verifier, not OIDCProxy"
    assert required_scopes is None, "configure required_scopes on the token_verifier, not OIDCProxy"

try:
    proxy = OIDCProxy(..., token_verifier=verifier)
except ValueError as e:
    logger.error("conflicting verifier options: %s", e)
    raise SystemExit(1)

When it happens

Trigger: Constructing OIDCProxy(token_verifier=my_verifier, algorithm="RS256", ...) — passing algorithm (or required_scopes) alongside a custom verifier.

Common situations: Migrating from the default JWT verifier (where algorithm= is valid) to a custom verifier while keeping the old algorithm argument; copy-pasted config samples combining both options.

Related errors

• OIDC discovery document for issuer {issuer!r} has no jwks_ur
• Missing required configuration metadata: {attr}
• Invalid URL for configuration metadata: {attr}
• Missing required config URL
• Missing required client id

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/211f91cfc891b94b. Report an issue: GitHub.