{"record":{"id":"466d789b14739c2d","repo":"siyuan-note/siyuan","slug":"oauth-token-endpoint-returned-unsupported-token-ty","errorCode":null,"errorMessage":"OAuth token endpoint returned unsupported token type %q","messagePattern":"OAuth token endpoint returned unsupported token type %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":403,"sourceCode":"\tif callback.Error != \"\" {\n\t\treturn fmt.Errorf(\"OAuth authorization failed: %s\", callback.Error)\n\t}\n\tif callback.State != state {\n\t\treturn fmt.Errorf(\"OAuth state mismatch\")\n\t}\n\tif callback.Code == \"\" {\n\t\treturn fmt.Errorf(\"OAuth callback did not include an authorization code\")\n\t}\n\n\texchangeCtx := context.WithValue(ctx, oauth2.HTTPClient, h.client)\n\ttoken, err := config.Exchange(exchangeCtx, callback.Code,\n\t\toauth2.VerifierOption(verifier),\n\t\toauth2.SetAuthURLParam(\"resource\", prm.Resource))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"exchange OAuth authorization code: %w\", err)\n\t}\n\tif token.TokenType != \"\" && !strings.EqualFold(token.TokenType, \"Bearer\") {\n\t\treturn fmt.Errorf(\"OAuth token endpoint returned unsupported token type %q\", token.TokenType)\n\t}\n\tcredential = registrationCredential\n\tcredential.TokenAuthMethod = authMethod\n\tcredential.AccessToken = token.AccessToken\n\tcredential.RefreshToken = token.RefreshToken\n\tcredential.TokenType = token.TokenType\n\tcredential.Expiry = token.Expiry\n\tcredential.Scopes = scopes\n\tcredential.Rejected = false\n\tif err = putOAuthCredential(credential); err != nil {\n\t\treturn fmt.Errorf(\"save OAuth credentials: %w\", err)\n\t}\n\th.sourceMu.Lock()\n\th.source = &storedOAuthTokenSource{credential: credential, client: h.client}\n\th.sourceMu.Unlock()\n\tsetMCPRuntimeStateForContext(ctx, h.server.ID, \"oauth_retrying\", 0, \"\", \"\")\n\treturn nil\n}","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L385-L421","documentation":"Returned at oauth.go:402-403 when the token exchange succeeded but token.TokenType is non-empty and not 'Bearer' (case-insensitive). SiYuan's storedOAuthTokenSource produces Bearer-bearing requests, so non-Bearer token types (DPoP, mac, N_A) cannot be used.","triggerScenarios":"The token endpoint's JSON response has \"token_type\":\"DPoP\" or similar. SiYuan checks token.TokenType != \"\" && !EqualFold(...,\"Bearer\") and rejects it before saving.","commonSituations":"AS enforces sender-constrained tokens (DPoP, mTLS-bound); AS returns a non-standard token_type string; AS bug returning the wrong type for the requested method.","solutions":["Configure the AS to issue Bearer tokens (token_type='Bearer') for this client.","If sender-constrained tokens are mandatory, use a different AS or a proxy that terminates the constraint and re-issues Bearer tokens.","Verify the registration requested a compatible token_endpoint_auth_method (none/client_secret_post/client_secret_basic)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"if token.TokenType != \"\" && !strings.EqualFold(token.TokenType, \"Bearer\") {\n    // Non-retriable: AS issues sender-constrained tokens. Surface and stop.\n    return fmt.Errorf(\"OAuth token endpoint returned unsupported token type %q\", token.TokenType)\n}","preventionTips":["Configure the AS to issue Bearer tokens for native clients.","Avoid AS deployments that mandate DPoP/mTLS-bound tokens when integrating SiYuan."],"tags":["oauth","mcp","token-type","bearer","token-endpoint"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}