{"record":{"id":"1549ba004f66ccd7","repo":"spring-projects/spring-security","slug":"server-error-1549ba","errorCode":"SERVER_ERROR","errorMessage":"The token generator failed to generate the access token.","messagePattern":"The token generator failed to generate the access token\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java","lineNumber":147,"sourceCode":"\t\tDefaultOAuth2TokenContext.Builder tokenContextBuilder = DefaultOAuth2TokenContext.builder()\n\t\t\t\t.registeredClient(registeredClient)\n\t\t\t\t.principal(clientPrincipal)\n\t\t\t\t.authorizationServerContext(AuthorizationServerContextHolder.getContext())\n\t\t\t\t.authorizedScopes(authorizedScopes)\n\t\t\t\t.tokenType(OAuth2TokenType.ACCESS_TOKEN)\n\t\t\t\t.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)\n\t\t\t\t.authorizationGrant(clientCredentialsAuthentication);\n\t\t// @formatter:on\n\t\tif (dPoPProof != null) {\n\t\t\ttokenContextBuilder.put(OAuth2TokenContext.DPOP_PROOF_KEY, dPoPProof);\n\t\t}\n\t\tOAuth2TokenContext tokenContext = tokenContextBuilder.build();\n\n\t\tOAuth2Token generatedAccessToken = this.tokenGenerator.generate(tokenContext);\n\t\tif (generatedAccessToken == null) {\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"The token generator failed to generate the access token.\", ERROR_URI);\n\t\t\tthrow new OAuth2AuthenticationException(error);\n\t\t}\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Generated access token\");\n\t\t}\n\n\t\t// @formatter:off\n\t\tOAuth2Authorization.Builder authorizationBuilder = OAuth2Authorization.withRegisteredClient(registeredClient)\n\t\t\t\t.principalName(clientPrincipal.getName())\n\t\t\t\t.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)\n\t\t\t\t.authorizedScopes(authorizedScopes);\n\t\t// @formatter:on\n\n\t\tOAuth2AccessToken accessToken = OAuth2AuthenticationProviderUtils.accessToken(authorizationBuilder,\n\t\t\t\tgeneratedAccessToken, tokenContext);\n\n\t\tOAuth2Authorization authorization = authorizationBuilder.build();\n","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java#L129-L165","documentation":"In OAuth2ClientCredentialsAuthenticationProvider.authenticate (the client_credentials grant at the token endpoint), the OAuth2TokenGenerator must produce an access token for the built token context. If generate() returns null — no generator in the chain supports this context — the provider throws this SERVER_ERROR OAuth2AuthenticationException.","triggerScenarios":"A client calls the token endpoint with grant_type=client_credentials while the authorization server's OAuth2TokenGenerator returns null for the ACCESS_TOKEN context (e.g. a custom generator without an encoder, or wrong token settings for JWT/reference format).","commonSituations":"Replacing the default token generator bean with a narrow custom one; JwtEncoder/JWKSource misconfiguration so JwtGenerator effectively fails or is excluded; token settings (access token TTL/format) not matching available generators.","solutions":["Use the composite token generator (e.g. DelegatingOAuth2TokenGenerator(JwtGenerator, OAuth2AccessTokenGenerator, OAuth2RefreshTokenGenerator)) built by OAuth2ConfigurerUtils.","If a custom generator is used, make it return a non-null token for ACCESS_TOKEN contexts or delegate to the next generator.","Verify the NimbusJwtEncoder and JWKSource beans are correctly configured so JwtGenerator can encode tokens.","Check the RegisteredClient token settings to ensure the requested access-token format matches an available generator."],"exampleFix":"// before\n@Bean\nOAuth2TokenGenerator<?> tokenGenerator() {\n    return new OAuth2AccessTokenGenerator(); // no JWT support; fails JWT contexts\n}\n\n// after\n@Bean\nOAuth2TokenGenerator<?> tokenGenerator(JWKSource<SecurityContext> jwkSource) {\n    JwtGenerator jwtGenerator = new JwtGenerator(new NimbusJwtEncoder(jwkSource));\n    return new DelegatingOAuth2TokenGenerator(jwtGenerator, new OAuth2AccessTokenGenerator());\n}","handlingStrategy":"try-catch","validationCode":"OAuth2Token t = tokenGenerator.generate(clientCredentialsAccessTokenContext);\nif (t == null) {\n    throw new IllegalStateException(\"Token generator must handle ACCESS_TOKEN contexts for client_credentials\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // POST /oauth2/token grant_type=client_credentials\n} catch (OAuth2AuthenticationException ex) {\n    if (OAuth2ErrorCodes.SERVER_ERROR.equals(ex.getError().getErrorCode())\n        && ex.getError().getDescription().contains(\"access token\")) {\n        log.error(\"client_credentials failed: no generator produced an access token; check JwtGenerator wiring\");\n    }\n    throw ex;\n}","preventionTips":["Use the standard composite token generator (JwtGenerator + OAuth2AccessTokenGenerator)","Keep NimbusJwtEncoder/JWKSource beans intact when customizing authorization server config","Add a client_credentials integration test to your CI pipeline for the authorization server"],"tags":["oauth2","client-credentials","access-token","token-generation"],"backgroundTag":"missing-configuration","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}