PrefectHQ/fastmcp · error · ValueError

Missing required OIDC endpoints

Error message

Missing required OIDC endpoints

What it means

OIDCProxy fetches the provider's OpenID Connect discovery document from config_url and needs at minimum the authorization_endpoint and token_endpoint to run the OAuth flow. If the fetched discovery document lacks either, the configuration is unusable and the proxy raises ValueError during __init__.

Source

Thrown at fastmcp_slim/fastmcp/server/auth/oidc_proxy.py:389

                )
            if required_scopes is not None:
                raise ValueError(
                    "Cannot specify 'required_scopes' when providing a custom token_verifier. "
                    "Configure required scopes on your token verifier instead."
                )

        if isinstance(config_url, str):
            config_url = AnyHttpUrl(config_url)

        self.oidc_config = self.get_oidc_configuration(
            config_url, strict, timeout_seconds
        )
        if (
            not self.oidc_config.authorization_endpoint
            or not self.oidc_config.token_endpoint
        ):
            logger.debug(f"Invalid OIDC Configuration: {self.oidc_config}")
            raise ValueError("Missing required OIDC endpoints")

        revocation_endpoint = (
            str(self.oidc_config.revocation_endpoint)
            if self.oidc_config.revocation_endpoint
            else None
        )

        # Use custom verifier if provided, otherwise create default JWTVerifier
        if token_verifier is None:
            # When verifying id_tokens:
            # - aud is always the OAuth client_id (per OIDC Core §2), not
            #   the API audience, so use client_id for audience validation.
            # - id_tokens don't carry scope/scp claims, so don't pass
            #   required_scopes to the verifier (scope enforcement happens
            #   at the FastMCP token level instead).
            verifier_audience = client_id if verify_id_token else audience
            verifier_scopes = None if verify_id_token else required_scopes
            token_verifier = self.get_token_verifier(

View on GitHub (pinned to 1f02114297)

Solutions

1. Verify config_url returns a valid OIDC discovery document containing authorization_endpoint and token_endpoint (open config_url in a browser/curl).
2. Correct the URL — typically it should be the issuer root, e.g. https://provider.com/.well-known/openid-configuration or the base issuer URL depending on the provider.
3. If the provider truly lacks discovery, construct OIDCConfiguration manually with explicit endpoint URLs and pass that instead of config_url.

Example fix

// before
proxy = OIDCProxy(config_url="https://idp.example.com")  # serves no discovery doc
// after
proxy = OIDCProxy(config_url="https://idp.example.com/.well-known/openid-configuration")

import httpx
cfg = httpx.get(config_url, timeout=5).json()
missing = [k for k in ("authorization_endpoint", "token_endpoint") if not cfg.get(k)]
if missing:
    raise ValueError(f"Discovery doc missing: {missing}")

def is_valid_discovery(cfg: dict | None) -> bool:
    return bool(cfg and cfg.get("authorization_endpoint") and cfg.get("token_endpoint"))

try:
    proxy = OIDCProxy(config_url=url, client_id=cid)
except ValueError as e:
    if "Missing required OIDC endpoints" in str(e):
        logger.error(f"Discovery at {url} lacks authorization/token endpoints")
    raise

When it happens

Trigger: OIDCProxy(config_url=...) where the served .well-known/openid-configuration (or the manually built OIDCConfiguration) omits authorization_endpoint or token_endpoint.

Common situations: Pointing config_url at a non-OIDC URL (plain HTML page, wrong path); a partial/broken identity provider that only issues discovery for some endpoints; mocking config in tests with an incomplete payload; network middleware returning an error body that fails parsing into empty fields.

Related errors

• Cannot specify 'required_scopes' when providing a custom tok
• AzureProvider requires at least one non-OIDC scope in requir
• Could not extract project_id from config_url: {issuer_url}
• OAuth provider has no server URL. Either pass mcp_url to OAu
• OAuth server rejected the static client credentials. Verify

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/f3e8f300cdf416b7. Report an issue: GitHub.