{"record":{"id":"3aa78ee0f36090ff","repo":"PrefectHQ/fastmcp","slug":"cimd-document-must-specify-private-key-jwt-auth-me","errorCode":null,"errorMessage":"CIMD document must specify private_key_jwt auth method","messagePattern":"CIMD document must specify private_key_jwt auth method","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/cimd.py","lineNumber":821,"sourceCode":"        \"\"\"Validate JWT assertion for private_key_jwt auth.\n\n        Args:\n            assertion: JWT assertion string from client\n            client: OAuth proxy client (must have cimd_document)\n            token_endpoint: Token endpoint URL for aud validation\n\n        Returns:\n            True if assertion is valid\n\n        Raises:\n            ValueError: If client doesn't have CIMD document or validation fails\n        \"\"\"\n        if not hasattr(client, \"cimd_document\") or not client.cimd_document:\n            raise ValueError(\"Client must have CIMD document for private_key_jwt\")\n\n        cimd_doc = client.cimd_document\n        if cimd_doc.token_endpoint_auth_method != \"private_key_jwt\":\n            raise ValueError(\"CIMD document must specify private_key_jwt auth method\")\n\n        return await self._assertion_validator.validate_assertion(\n            assertion, client.client_id, token_endpoint, cimd_doc\n        )\n","sourceCodeStart":803,"sourceCodeEnd":826,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/cimd.py#L803-L826","documentation":"The client has a CIMD document, but that document's `token_endpoint_auth_method` is not `\"private_key_jwt\"`. The library refuses to validate a private_key_jwt assertion against metadata that declares a different authentication method.","triggerScenarios":"`validate_private_key_jwt` is called (via `authenticate_request`) with a client whose CIMD metadata declares e.g. `client_secret_basic`, `client_secret_post`, `none`, or `self_signed_tls_client_auth` while the token request uses private_key_jwt.","commonSituations":"Mismatch between what the client developer implemented and what the published CIMD document declares; the CIMD document was updated (method changed) but the client still sends private_key_jwt; a copy-pasted metadata file with the wrong auth method.","solutions":["Update the CIMD document to set `token_endpoint_auth_method: \"private_key_jwt\"` if that is the intended method","Alternatively, change the client to use the auth method declared in its CIMD document","Redeploy/refresh the metadata so the cached CIMD document reflects the corrected method"],"exampleFix":"// before (CIMD document)\n{\"token_endpoint_auth_method\": \"client_secret_post\", ...}\n// after\n{\"token_endpoint_auth_method\": \"private_key_jwt\", \"jwks\": {\"keys\": [...]} }","handlingStrategy":"validation","validationCode":"doc = client.cimd_document\nif doc.token_endpoint_auth_method != \"private_key_jwt\":\n    raise RuntimeError(f\"CIMD doc declares {doc.token_endpoint_auth_method!r}; client uses private_key_jwt\")","typeGuard":"def supports_private_key_jwt(doc) -> bool:\n    return getattr(doc, \"token_endpoint_auth_method\", None) == \"private_key_jwt\"","tryCatchPattern":"try:\n    await manager.validate_private_key_jwt(assertion, client, endpoint)\nexcept ValueError as e:\n    if \"must specify private_key_jwt\" in str(e):\n        logger.error(\"Auth method mismatch between client request and CIMD metadata\")\n    raise","preventionTips":["Keep the client's token request auth method in sync with its published CIMD metadata","Re-check the CIMD document whenever the client's auth configuration changes","Test end-to-end after editing the metadata document (caches may serve stale values)","Declare `token_endpoint_auth_method: \"private_key_jwt\"` explicitly, don't rely on defaults"],"tags":["oauth","cimd","auth-method-mismatch","private-key-jwt"],"backgroundTag":"auth-method-mismatch","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}