{"record":{"id":"2baa5d93fb637542","repo":"thephpleague/oauth2-server","slug":"unsupported-grant-type","errorCode":null,"errorMessage":"unsupported grant type","messagePattern":"unsupported grant type","errorType":"http","errorClass":"OAuthServerException","httpStatus":400,"severity":"error","filePath":"src/AuthorizationServer.php","lineNumber":126,"sourceCode":"\n    /**\n     * Validate an authorization request\n     *\n     * @throws OAuthServerException\n     */\n    public function validateAuthorizationRequest(ServerRequestInterface $request): AuthorizationRequestInterface\n    {\n        if (!isset($request->getQueryParams()['response_type'])) {\n            throw OAuthServerException::invalidRequest('response_type');\n        }\n\n        foreach ($this->enabledGrantTypes as $grantType) {\n            if ($grantType->canRespondToAuthorizationRequest($request)) {\n                return $grantType->validateAuthorizationRequest($request);\n            }\n        }\n\n        throw OAuthServerException::unsupportedGrantType();\n    }\n\n    /**\n     * Complete an authorization request\n     */\n    public function completeAuthorizationRequest(\n        AuthorizationRequestInterface $authRequest,\n        ResponseInterface $response\n    ): ResponseInterface {\n        return $this->enabledGrantTypes[$authRequest->getGrantTypeId()]\n            ->completeAuthorizationRequest($authRequest)\n            ->generateHttpResponse($response);\n    }\n\n    /**\n     * Respond to device authorization request\n     *\n     * @throws OAuthServerException","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/AuthorizationServer.php#L108-L144","documentation":"Thrown by validateAuthorizationRequest when the request has a response_type but none of the registered grant types can respond to the authorization request. Usually means no authorization-code grant is enabled on the server or the request is malformed for that grant.","triggerScenarios":"AuthorizationServer->enableGrantType() was never called with an AuthCodeGrant (or the one enabled doesn't match the request), yet validateAuthorizationRequest() is invoked with response_type=code.","commonSituations":"Server only configured with client_credentials/password grants but an authorize endpoint is hit; typo in response_type; client sends response_type the enabled grants don't handle.","solutions":["Enable the authorization code grant: $server->enableGrantType(new AuthCodeGrant($authCodeRepo, $refreshTokenRepo, new DateInterval('PT10M'))).","Check response_type matches a grant that supports authorization requests (code/token, not client_credentials).","Confirm $this->enabledGrantTypes is populated before handling /authorize."],"exampleFix":"// before\n$server->enableGrantType(new ClientCredentialsGrant());\n// after\n$server->enableGrantType(new ClientCredentialsGrant());\n$server->enableGrantType(new AuthCodeGrant($authCodeRepository, $refreshTokenRepository, new \\DateInterval('PT10M')));","handlingStrategy":"validation","validationCode":"$hasAuthCodeGrant = false;\nforeach ($grants as $g) { if ($g instanceof AuthCodeGrant) { $hasAuthCodeGrant = true; } }\nif (!$hasAuthCodeGrant) throw new \\RuntimeException('No grant enabled for /authorize');","typeGuard":null,"tryCatchPattern":"try { $req = $server->validateAuthorizationRequest($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response()); }","preventionTips":["Enable all grants the endpoint must serve at bootstrap","Keep a config list of grant identifiers and enable each in a loop"],"tags":["oauth","grant-type","configuration"],"backgroundTag":"unsupported-operation","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}