alibaba/nacos · error · AccessException

Token endpoint not configured

Error message

Token endpoint not configured

What it means

Thrown by AuthorizationCodeHandler.exchangeCodeForTokens when the OIDC provider metadata's token_endpoint is blank. The token endpoint is obtained from the discovery document (OidcProviderMetadataProvider.getMetadata()), not configured directly. Without it Nacos cannot POST the authorization code to exchange it for ID/access tokens.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java:218

            throw e;
        } catch (Exception e) {
            LOGGER.error("Failed to exchange code for tokens", e);
            throw new AccessException("Authentication failed: " + e.getMessage());
        }
    }
    
    /**
     * Exchange authorization code for OIDC tokens.
     *
     * @param code        authorization code
     * @param redirectUri redirect URI
     * @return OIDC tokens
     * @throws Exception if exchange fails
     */
    private OIDCTokens exchangeCodeForTokens(String code, String redirectUri) throws Exception {
        String tokenEndpoint = metadataProvider.getMetadata().getTokenEndpoint();
        if (StringUtils.isBlank(tokenEndpoint)) {
            throw new AccessException("Token endpoint not configured");
        }
        
        // Build token request
        AuthorizationCode authCode = new AuthorizationCode(code);
        AuthorizationGrant grant = new AuthorizationCodeGrant(authCode, URI.create(redirectUri));
        
        // Client authentication
        ClientAuthentication clientAuth = new ClientSecretBasic(
            new ClientID(config.getClientId()),
            new Secret(config.getClientSecret()));
        
        // Send token request
        TokenRequest tokenRequest = new TokenRequest(
            URI.create(tokenEndpoint),
            clientAuth,
            grant);
        
        TokenResponse tokenResponse =

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Verify the IdP discovery document at <issuer-uri>/.well-known/openid-configuration actually contains a non-empty token_endpoint field (curl it and inspect the JSON).
2. Confirm issuer-uri is correct and points to the OIDC root, not a sub-path or the JWKS URL.
3. If discovery is broken, ensure OidcProviderMetadataProvider successfully discovered (check the log line 'OIDC configuration discovered: jwksUri=...'); a missing log means discovery failed and metadata is null.
4. Use a fully OIDC-compliant IdP (Keycloak, Auth0, Google) that publishes token_endpoint.

Example fix

// before: issuer-uri points to a doc without token_endpoint
nacos.plugin.auth.oidc.issuer-uri=https://example.com/oauth2
// after: point at the OIDC issuer root whose discovery doc includes token_endpoint
nacos.plugin.auth.oidc.issuer-uri=https://keycloak.example.com/realms/myrealm

// Before triggering authorization-code flow, confirm discovery populated a token endpoint
OidcProviderMetadata meta = metadataProvider.getMetadata();
if (StringUtils.isBlank(meta.getTokenEndpoint())) {
    throw new IllegalStateException(
        "IdP discovery doc has no token_endpoint; authorize-code flow unavailable");
}

try {
    handler.exchangeCodeForUser(code, state, redirectUri);
} catch (AccessException e) {
    if (e.getMessage().contains("Token endpoint not configured")) {
        // discovery issue — surface a clear config error, do not retry the same code
        log.error("OIDC token endpoint missing from discovery; check issuer-uri and IdP config");
    }
    throw e;
}

When it happens

Trigger: OIDC discovery ran but the IdP's .well-known/openid-configuration JSON omitted the token_endpoint field, or discovery has not completed yet and metadata returns all-null fields, or the issuer-uri points at a document that is not a real OIDC discovery doc.

Common situations: Using a non-OIDC OAuth2 provider that has no token_endpoint; pointing issuer-uri at a partial/custom discovery doc; discovery endpoint returned 200 but a truncated body so all endpoints are null; the provider only supports a different flow (e.g. implicit only).

Related errors

• Failed to sign payload
• Client secret is required for state signing
• Authorization endpoint not configured
• Token exchange failed:
• Issuer URI is not configured

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/dfcf07f1d0978d80. Report an issue: GitHub.