{"record":{"id":"4e230c44c32c68c5","repo":"PrefectHQ/fastmcp","slug":"unsupported-token-endpoint-auth-method-method-r","errorCode":null,"errorMessage":"Unsupported token_endpoint_auth_method: {method!r}. Supported methods: client_secret_basic, client_secret_post, none.","messagePattern":"Unsupported token_endpoint_auth_method: (.+?)\\. Supported methods: client_secret_basic, client_secret_post, none\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/oauth_proxy/upstream.py","lineNumber":79,"sourceCode":"        self._client = httpx2.AsyncClient(timeout=timeout)\n\n    async def aclose(self) -> None:\n        await self._client.aclose()\n\n    def _apply_client_auth(self, data: dict[str, Any], headers: dict[str, str]) -> None:\n        \"\"\"Attach client credentials per the configured auth method (RFC 6749 §2.3).\"\"\"\n        method = self.token_endpoint_auth_method\n        if method == \"client_secret_basic\":\n            text = f\"{self.client_id}:{self.client_secret}\"\n            credential = base64.b64encode(text.encode(\"latin1\")).decode(\"ascii\")\n            headers[\"Authorization\"] = f\"Basic {credential}\"\n        elif method == \"client_secret_post\":\n            data[\"client_id\"] = self.client_id\n            data[\"client_secret\"] = self.client_secret or \"\"\n        elif method == \"none\":\n            data[\"client_id\"] = self.client_id\n        else:\n            raise ValueError(\n                f\"Unsupported token_endpoint_auth_method: {method!r}. \"\n                \"Supported methods: client_secret_basic, client_secret_post, none.\"\n            )\n\n    async def _request_token(self, url: str, data: dict[str, Any]) -> dict[str, Any]:\n        headers = dict(_DEFAULT_TOKEN_HEADERS)\n        self._apply_client_auth(data, headers)\n\n        response = await self._client.post(url, data=data, headers=headers)\n        if response.status_code >= 500:\n            response.raise_for_status()\n\n        token: dict[str, Any] = response.json()\n        if \"error\" in token:\n            raise OAuthError(\n                error=token[\"error\"], description=token.get(\"error_description\")\n            )\n","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/oauth_proxy/upstream.py#L61-L97","documentation":"The upstream OAuth client was configured with a token_endpoint_auth_method the library does not implement. Only client_secret_basic, client_secret_post, and none are supported; anything else (e.g. private_key_jwt, tls_client_auth) raises this ValueError when building the token request.","triggerScenarios":"Constructing an upstream OAuth client with token_endpoint_auth_method set to an unsupported string (typo, or an auth method like 'private_key_jwt'), then performing any token request (fetch/refresh).","commonSituations":"Typo like 'client_secret_basic ' or wrong casing; copying a config from a provider that requires private_key_jwt (e.g. some enterprise IdPs); default config objects carrying methods this library hasn't implemented.","solutions":["Set token_endpoint_auth_method to one of: client_secret_basic, client_secret_post, or none","If your provider requires private_key_jwt or another unsupported method, use jwt_signing_key / identity assertion support or a different auth path","Check for typos and exact casing of the method string"],"exampleFix":"// before\nUpstreamOAuthClient(token_endpoint_auth_method=\"private_key_jwt\", ...)\n// after\nUpstreamOAuthClient(token_endpoint_auth_method=\"client_secret_post\", ...)","handlingStrategy":"validation","validationCode":"SUPPORTED = {\"client_secret_basic\", \"client_secret_post\", \"none\"}\nif token_endpoint_auth_method not in SUPPORTED:\n    raise ValueError(f\"token_endpoint_auth_method must be one of {sorted(SUPPORTED)}\")","typeGuard":"from typing import Literal\nAuthMethod = Literal[\"client_secret_basic\", \"client_secret_post\", \"none\"]\ndef is_supported_auth_method(m: str) -> TypeGuard[AuthMethod]:\n    return m in {\"client_secret_basic\", \"client_secret_post\", \"none\"}","tryCatchPattern":"try:\n    client = UpstreamOAuthClient(token_endpoint_auth_method=method, ...)\nexcept ValueError as e:\n    logger.error(\"bad auth method: %s\", e)\n    raise SystemExit(1)","preventionTips":["Use the Literal/enum type for auth method in your config layer","Validate provider requirements against supported methods before deployment","Never hand-type the method string; centralize it in one constant"],"tags":["oauth","configuration","auth-method"],"backgroundTag":"unsupported-auth-method","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}