{"record":{"id":"40a6cd6d44034bce","repo":"siyuan-note/siyuan","slug":"oauth-client-registration-returned-an-unsupported","errorCode":null,"errorMessage":"OAuth client registration returned an unsupported token endpoint authentication method","messagePattern":"OAuth client registration returned an unsupported token endpoint authentication method","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":332,"sourceCode":"\t\t\tResourceMetadataURL: prm.MetadataURL,\n\t\t\tRedirectURL:         callbackURL,\n\t\t\tClientID:            registration.ClientID,\n\t\t\tClientSecret:        registration.ClientSecret,\n\t\t\tClientSecretExpiry:  registration.ClientSecretExpiresAt,\n\t\t\tTokenEndpoint:       asm.TokenEndpoint,\n\t\t\tRevocationEndpoint:  asm.RevocationEndpoint,\n\t\t\tTokenAuthMethod:     registration.TokenEndpointAuthMethod,\n\t\t\tScopes:              scopes,\n\t\t}\n\t\tif registrationCredential.TokenAuthMethod == \"\" {\n\t\t\tif registration.ClientSecret == \"\" {\n\t\t\t\tregistrationCredential.TokenAuthMethod = \"none\"\n\t\t\t} else {\n\t\t\t\tregistrationCredential.TokenAuthMethod = \"client_secret_basic\"\n\t\t\t}\n\t\t}\n\t\tif !isSupportedTokenAuthMethod(registrationCredential.TokenAuthMethod) {\n\t\t\treturn fmt.Errorf(\"OAuth client registration returned an unsupported token endpoint authentication method\")\n\t\t}\n\t\tif err = putOAuthCredential(registrationCredential); err != nil {\n\t\t\treturn fmt.Errorf(\"save OAuth client registration: %w\", err)\n\t\t}\n\t}\n\n\tauthMethod := registrationCredential.TokenAuthMethod\n\tif authMethod == \"\" {\n\t\tif registrationCredential.ClientSecret == \"\" {\n\t\t\tauthMethod = \"none\"\n\t\t} else {\n\t\t\tauthMethod = \"client_secret_basic\"\n\t\t}\n\t}\n\tconfig := &oauth2.Config{\n\t\tClientID:     registrationCredential.ClientID,\n\t\tClientSecret: registrationCredential.ClientSecret,\n\t\tRedirectURL:  callbackURL,","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L314-L350","documentation":"Thrown at oauth.go:331-332 after a registration succeeds but the TokenEndpointAuthMethod returned (or defaulted) is not one of the three SiYuan supports (none/client_secret_post/client_secret_basic per isSupportedTokenAuthMethod). This guards against an AS assigning a stronger auth method during registration than it advertised.","triggerScenarios":"RegisterClient returns a registration whose token_endpoint_auth_method is e.g. 'tls_client_auth' or 'private_key_jwt' (or the server omits a client_secret while returning a method requiring one, which then defaults incorrectly). The subsequent isSupportedTokenAuthMethod check fails.","commonSituations":"AS forces mTLS/JWT-bound clients regardless of requested metadata; AS bug returning a method not requested; AS assigns client_secret_basic but SiYuan's defaulting logic produced an unexpected value when secret was empty.","solutions":["Re-register requesting 'none' or 'client_secret_post' explicitly and confirm the AS honors the requested token_endpoint_auth_method.","If the AS mandates a stronger method, route through an AS or proxy that accepts none/client_secret_post/client_secret_basic.","Report to the AS operator if the returned method contradicts the metadata's token_endpoint_auth_methods_supported."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// After RegisterClient returns, before persisting:\nmethod := registration.TokenEndpointAuthMethod\nif method == \"\" {\n    if registration.ClientSecret == \"\" { method = \"none\" } else { method = \"client_secret_basic\" }\n}\nif method != \"none\" && method != \"client_secret_post\" && method != \"client_secret_basic\" {\n    return fmt.Errorf(\"AS assigned incompatible token auth method %q; re-register requesting none/client_secret_post\", method)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Explicitly request 'none' or 'client_secret_post' in ClientRegistrationMetadata.TokenEndpointAuthMethod.","Reject AS deployments that override the requested method with mTLS/JWT."],"tags":["oauth","mcp","token-auth","dynamic-client-registration","registration-response"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}