{"record":{"id":"0f80bd1e87b5be6f","repo":"vercel/ai","slug":"incompatible-auth-server-does-not-support-respons","errorCode":null,"errorMessage":"Incompatible auth server: does not support response type ${responseType}","messagePattern":"Incompatible auth server: does not support response type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/mcp/src/tool/oauth.ts","lineNumber":702,"sourceCode":"    resource,\n  }: {\n    metadata?: AuthorizationServerMetadata;\n    clientInformation: OAuthClientInformation;\n    redirectUrl: string | URL;\n    scope?: string;\n    state?: string;\n    resource?: URL;\n  },\n): Promise<{ authorizationUrl: URL; codeVerifier: string }> {\n  const responseType = 'code';\n  const codeChallengeMethod = 'S256';\n\n  let authorizationUrl: URL;\n  if (metadata) {\n    authorizationUrl = new URL(metadata.authorization_endpoint);\n\n    if (!metadata.response_types_supported.includes(responseType)) {\n      throw new Error(\n        `Incompatible auth server: does not support response type ${responseType}`,\n      );\n    }\n\n    if (\n      !metadata.code_challenge_methods_supported ||\n      !metadata.code_challenge_methods_supported.includes(codeChallengeMethod)\n    ) {\n      throw new Error(\n        `Incompatible auth server: does not support code challenge method ${codeChallengeMethod}`,\n      );\n    }\n  } else {\n    authorizationUrl = new URL('/authorize', authorizationServerUrl);\n  }\n\n  const challenge = await pkceChallenge();\n  const codeVerifier = challenge.code_verifier;","sourceCodeStart":684,"sourceCodeEnd":720,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/mcp/src/tool/oauth.ts#L684-L720","documentation":"startAuthorization hard-codes the OAuth response type 'code' (authorization code flow). If discovered authorization server metadata is present but its response_types_supported array does not include 'code', the function throws rather than building an authorization URL that the server would reject.","triggerScenarios":"Calling startAuthorization (directly or via auth()) with metadata whose response_types_supported excludes 'code' — e.g. a server advertising only implicit ('token') or hybrid flows.","commonSituations":"Pointing an MCP client at an authorization server configured for implicit-only flows (legacy OAuth2 setups, some old Azure AD v1 app registrations), or a metadata document with a truncated/incorrect response_types_supported list.","solutions":["Reconfigure the authorization server/client to support the authorization code flow (add 'code' to allowed response types).","Verify the server's metadata: curl the .well-known endpoint and check response_types_supported contains 'code'.","Ensure you are connecting to the correct authorization server (the one advertised in the MCP server's protected resource metadata), not a different one.","If the server only supports implicit flow, it cannot be used with MCP; switch to a compliant server."],"exampleFix":"// before: AS configured with response types [\"token\"] (implicit only)\n// after: enable authorization code flow for the client in the AS admin console\n// { \"response_types_supported\": [\"code\", \"token\"] }","handlingStrategy":"validation","validationCode":"const metadata = await discoverAuthorizationServerMetadata(asUrl);\nif (metadata && !metadata.response_types_supported.includes('code')) {\n  throw new Error('Auth server does not support the authorization code flow required by MCP');\n}","typeGuard":"function supportsCodeFlow(m: { response_types_supported: string[] }): boolean {\n  return Array.isArray(m.response_types_supported) && m.response_types_supported.includes('code');\n}","tryCatchPattern":"try {\n  await startAuthorization(asUrl, { metadata, clientInformation, redirectUrl });\n} catch (error) {\n  if (String(error.message).includes('does not support response type')) {\n    console.error('Enable the authorization code flow on the auth server client configuration.');\n  }\n}","preventionTips":["Verify response_types_supported includes 'code' before wiring an MCP server to an AS.","Avoid implicit-only OAuth client configurations for MCP integrations.","Fetch and store the AS metadata in your infra docs as part of setup."],"tags":["oauth","authorization-code-flow","metadata","mcp"],"backgroundTag":"oauth-flow-unsupported","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}