{"record":{"id":"211f91cfc891b94b","repo":"PrefectHQ/fastmcp","slug":"cannot-specify-algorithm-when-providing-a-custom","errorCode":null,"errorMessage":"Cannot specify 'algorithm' when providing a custom token_verifier. Configure the algorithm on your token verifier instead.","messagePattern":"Cannot specify 'algorithm' when providing a custom token_verifier\\. Configure the algorithm on your token verifier instead\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/oidc_proxy.py","lineNumber":368,"sourceCode":"            raise ValueError(\"Missing required config URL\")\n\n        if not client_id:\n            raise ValueError(\"Missing required client id\")\n\n        if not client_secret and not jwt_signing_key:\n            raise ValueError(\n                \"Either client_secret or jwt_signing_key must be provided. \"\n                \"jwt_signing_key is required when client_secret is omitted \"\n                \"(e.g., for PKCE public clients).\"\n            )\n\n        if not base_url:\n            raise ValueError(\"Missing required base URL\")\n\n        # Validate that verifier-specific parameters are not used with custom verifier\n        if token_verifier is not None:\n            if algorithm is not None:\n                raise ValueError(\n                    \"Cannot specify 'algorithm' when providing a custom token_verifier. \"\n                    \"Configure the algorithm on your token verifier instead.\"\n                )\n            if required_scopes is not None:\n                raise ValueError(\n                    \"Cannot specify 'required_scopes' when providing a custom token_verifier. \"\n                    \"Configure required scopes on your token verifier instead.\"\n                )\n\n        if isinstance(config_url, str):\n            config_url = AnyHttpUrl(config_url)\n\n        self.oidc_config = self.get_oidc_configuration(\n            config_url, strict, timeout_seconds\n        )\n        if (\n            not self.oidc_config.authorization_endpoint\n            or not self.oidc_config.token_endpoint","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/oidc_proxy.py#L350-L386","documentation":"When a custom token_verifier is supplied, OIDCProxy forbids also passing 'algorithm' because the verifier owns token-validation settings; the two would conflict. The message tells you to configure the algorithm on the verifier itself. (Similarly required_scopes is disallowed in the same block.)","triggerScenarios":"Constructing OIDCProxy(token_verifier=my_verifier, algorithm=\"RS256\", ...) — passing algorithm (or required_scopes) alongside a custom verifier.","commonSituations":"Migrating from the default JWT verifier (where algorithm= is valid) to a custom verifier while keeping the old algorithm argument; copy-pasted config samples combining both options.","solutions":["Remove the algorithm argument from OIDCProxy and set it on your custom token_verifier instead","Also remove required_scopes if you pass a custom verifier (same restriction)","Only pass algorithm when relying on the built-in JWT verification (no custom token_verifier)"],"exampleFix":"// before\nproxy = OIDCProxy(..., token_verifier=my_verifier, algorithm=\"RS256\")\n// after\nverifier = MyVerifier(algorithm=\"RS256\")\nproxy = OIDCProxy(..., token_verifier=verifier)","handlingStrategy":"validation","validationCode":"if token_verifier is not None:\n    assert algorithm is None, \"configure algorithm on the token_verifier, not OIDCProxy\"\n    assert required_scopes is None, \"configure required_scopes on the token_verifier, not OIDCProxy\"","typeGuard":null,"tryCatchPattern":"try:\n    proxy = OIDCProxy(..., token_verifier=verifier)\nexcept ValueError as e:\n    logger.error(\"conflicting verifier options: %s\", e)\n    raise SystemExit(1)","preventionTips":["When switching to a custom token_verifier, remove algorithm/required_scopes from OIDCProxy kwargs","Keep verifier options encapsulated in the verifier class","Write a small config smoke test that constructs OIDCProxy at CI time to catch conflicts early"],"tags":["oidc","configuration","conflicting-options"],"backgroundTag":"conflicting-configuration-options","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}