{"record":{"id":"7574bb6fbc36fff9","repo":"nextauthjs/next-auth","slug":"unsupported-client-authentication-method","errorCode":null,"errorMessage":"unsupported client authentication method","messagePattern":"unsupported client authentication method","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/callback.ts","lineNumber":125,"sourceCode":"    case \"client_secret_post\":\n      clientAuth = o.ClientSecretPost(provider.clientSecret!)\n      break\n    case \"client_secret_jwt\":\n      clientAuth = o.ClientSecretJwt(provider.clientSecret!)\n      break\n    case \"private_key_jwt\":\n      clientAuth = o.PrivateKeyJwt(provider.token!.clientPrivateKey!, {\n        // TODO: review in the next breaking change\n        [o.modifyAssertion](_header, payload) {\n          payload.aud = [as.issuer, as.token_endpoint!]\n        },\n      })\n      break\n    case \"none\":\n      clientAuth = o.None()\n      break\n    default:\n      throw new Error(\"unsupported client authentication method\")\n  }\n\n  const resCookies: Cookie[] = []\n\n  const state = await checks.state.use(cookies, resCookies, options)\n\n  let codeGrantParams: URLSearchParams\n  try {\n    codeGrantParams = o.validateAuthResponse(\n      as,\n      client,\n      new URLSearchParams(params),\n      provider.checks.includes(\"state\") ? state : o.skipStateCheck\n    )\n  } catch (err) {\n    if (err instanceof o.AuthorizationResponseError) {\n      const cause = {\n        providerId: provider.id,","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/callback.ts#L107-L143","documentation":"Auth.js selects the client authentication method for the token endpoint based on token_endpoint_auth_method; only client_secret_basic, client_secret_post, and none are supported. Any other value reaches the switch's default branch and throws Error('unsupported client authentication method'). The valid values mirror openid-client's supported authentication methods.","triggerScenarios":"A provider config (or discovery document) declares token_endpoint_auth_method with a value such as private_key_jwt, tls_client_auth, or an arbitrary string that Auth.js does not implement; a typo like \"client_secret_Post\" in a custom provider.","commonSituations":"Providers requiring advanced auth (mTLS, private_key_jwt — e.g. some enterprise/healthcare IdPs) being wired into Auth.js which lacks support; copy-pasting token_endpoint_auth_method from the IdP's docs verbatim; hand-written provider objects with invalid enum values.","solutions":["Set the provider's token_endpoint_auth_method to \"client_secret_basic\", \"client_secret_post\", or \"none\" (whichever the IdP accepts)","Check the IdP's discovery document for which methods its token endpoint supports and pick a supported one","If the IdP only supports private_key_jwt/mTLS, use a middleware or a different client that implements it, or ask the IdP to enable client_secret_* auth","Fix casing/typos in custom provider definitions"],"exampleFix":"// before\nconst provider = {\n  id: \"acme\", type: \"oidc\", issuer: \"https://sso.acme.com\",\n  token_endpoint_auth_method: \"private_key_jwt\", clientId, clientSecret\n}\n// after\nconst provider = {\n  id: \"acme\", type: \"oidc\", issuer: \"https://sso.acme.com\",\n  token_endpoint_auth_method: \"client_secret_post\", clientId, clientSecret\n}","handlingStrategy":"validation","validationCode":"const allowed = [\"client_secret_basic\", \"client_secret_post\", \"none\"]\nif (provider.token_endpoint_auth_method &&\n    !allowed.includes(provider.token_endpoint_auth_method)) {\n  throw new Error(`Unsupported auth method: ${provider.token_endpoint_auth_method}`)\n}","typeGuard":"function isSupportedAuthMethod(m: string): m is \"client_secret_basic\" | \"client_secret_post\" | \"none\" {\n  return [\"client_secret_basic\",\"client_secret_post\",\"none\"].includes(m)\n}","tryCatchPattern":"try {\n  await signIn(providerId)\n} catch (e) {\n  if ((e as Error).message === \"unsupported client authentication method\") {\n    // set token_endpoint_auth_method to a supported value\n  }\n}","preventionTips":["Only use client_secret_basic, client_secret_post, or none in provider configs","Read the IdP's discovery doc for supported token auth methods","Watch out for casing/typos in hand-written provider objects","For IdPs requiring private_key_jwt/mTLS, use a different integration layer"],"tags":["oauth","configuration","client-auth"],"backgroundTag":"unsupported-client-auth-method","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}