{"record":{"id":"7c0e9b4527208d40","repo":"vercel/ai","slug":"unsupported-client-authentication-method-method","errorCode":null,"errorMessage":"Unsupported client authentication method: ${method}","messagePattern":"Unsupported client authentication method: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/mcp/src/tool/oauth.ts","lineNumber":829,"sourceCode":"  method: ClientAuthMethod,\n  clientInformation: OAuthClientInformation,\n  headers: Headers,\n  params: URLSearchParams,\n): void {\n  const { client_id, client_secret } = clientInformation;\n\n  switch (method) {\n    case 'client_secret_basic':\n      applyBasicAuth(client_id, client_secret, headers);\n      return;\n    case 'client_secret_post':\n      applyPostAuth(client_id, client_secret, params);\n      return;\n    case 'none':\n      applyPublicAuth(client_id, params);\n      return;\n    default:\n      throw new Error(`Unsupported client authentication method: ${method}`);\n  }\n}\n\nfunction applyBasicAuth(\n  clientId: string,\n  clientSecret: string | undefined,\n  headers: Headers,\n): void {\n  if (!clientSecret) {\n    throw new Error(\n      'client_secret_basic authentication requires a client_secret',\n    );\n  }\n\n  const credentials = btoa(`${clientId}:${clientSecret}`);\n  headers.set('Authorization', `Basic ${credentials}`);\n}\n","sourceCodeStart":811,"sourceCodeEnd":847,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/mcp/src/tool/oauth.ts#L811-L847","documentation":"applyClientAuthentication switches on the client's configured token_endpoint_auth_method. The library supports 'client_secret_basic', 'client_secret_post', and 'none'; any other value falls through to the default case and throws. This indicates an unsupported/unknown client authentication method was supplied in client information or metadata.","triggerScenarios":"Calling exchangeAuthorization or refreshAuthorization (via auth()) where the resolved client auth method (from OAuthClientInformation/registration response, e.g. token_endpoint_auth_method) is something like 'client_secret_jwt', 'private_key_jwt', or any typo'd value.","commonSituations":"Dynamically registering a client against an AS that responds with a JWT-based auth method (private_key_jwt) the MCP client doesn't implement, or hand-writing client information with a misspelled auth method.","solutions":["Set the client's token_endpoint_auth_method to one of 'client_secret_basic', 'client_secret_post', or 'none' in the stored OAuthClientInformation or registration request.","If the AS forces private_key_jwt / client_secret_jwt, reconfigure the AS client to allow client_secret_post or client_secret_basic.","Check for typos in a hand-crafted clientInformation object and fix the method string.","Re-register the client (invalidate stored credentials via provider.invalidateCredentials('all')) so registration negotiates a supported method."],"exampleFix":"// before\nconst clientInformation = { client_id: 'abc', token_endpoint_auth_method: 'private_key_jwt' };\n// after\nconst clientInformation = { client_id: 'abc', client_secret: 'shhh', token_endpoint_auth_method: 'client_secret_post' };","handlingStrategy":"validation","validationCode":"const SUPPORTED = ['client_secret_basic', 'client_secret_post', 'none'];\nconst method = clientInformation.token_endpoint_auth_method ?? 'client_secret_basic';\nif (!SUPPORTED.includes(method)) {\n  throw new Error(`Reconfigure client: MCP supports only ${SUPPORTED.join(', ')}, got ${method}`);\n}","typeGuard":"function hasSupportedAuthMethod(m: unknown): m is { token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none' } {\n  return !!m && typeof m === 'object' && ['client_secret_basic', 'client_secret_post', 'none'].includes((m as any).token_endpoint_auth_method);\n}","tryCatchPattern":"try {\n  await auth(provider, { serverUrl });\n} catch (error) {\n  if (String(error.message).startsWith('Unsupported client authentication method')) {\n    await provider.invalidateCredentials?.('all'); // re-register with a supported method\n  }\n}","preventionTips":["Restrict the AS client to secret-based or public auth methods; avoid private_key_jwt for MCP clients.","Validate any hand-written OAuthClientInformation against the three supported methods.","Re-register clients if the AS responds with an unsupported token_endpoint_auth_method."],"tags":["oauth","client-authentication","mcp"],"backgroundTag":"oauth-auth-method-unsupported","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}