{"record":{"id":"96e78ca2dc3df4e9","repo":"vercel/ai","slug":"incompatible-auth-server-does-not-support-grant-t","errorCode":null,"errorMessage":"Incompatible auth server: does not support grant type ${grantType}","messagePattern":"Incompatible auth server: does not support grant type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/mcp/src/tool/oauth.ts","lineNumber":948,"sourceCode":"    codeVerifier: string;\n    redirectUri: string | URL;\n    resource?: URL;\n    addClientAuthentication?: OAuthClientProvider['addClientAuthentication'];\n    fetchFn?: FetchFunction;\n  },\n): Promise<OAuthTokens> {\n  const grantType = 'authorization_code';\n\n  const tokenUrl = metadata?.token_endpoint\n    ? new URL(metadata.token_endpoint)\n    : new URL('/token', authorizationServerUrl);\n  assertSafeOAuthEndpoint(tokenUrl);\n\n  if (\n    metadata?.grant_types_supported &&\n    !metadata.grant_types_supported.includes(grantType)\n  ) {\n    throw new Error(\n      `Incompatible auth server: does not support grant type ${grantType}`,\n    );\n  }\n\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n    Accept: 'application/json',\n  });\n  const params = new URLSearchParams({\n    grant_type: grantType,\n    code: authorizationCode,\n    code_verifier: codeVerifier,\n    redirect_uri: String(redirectUri),\n  });\n\n  if (addClientAuthentication) {\n    await addClientAuthentication(\n      headers,","sourceCodeStart":930,"sourceCodeEnd":966,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/mcp/src/tool/oauth.ts#L930-L966","documentation":"During authorization code exchange, if the authorization server metadata advertises grant_types_supported and the required grant type ('authorization_code') is not in the list, exchangeAuthorization throws before making the token request. This prevents a doomed HTTP call against a server that will not honor the grant.","triggerScenarios":"Calling exchangeAuthorization (via auth()) with metadata whose grant_types_supported is defined and excludes 'authorization_code' — e.g. a server configured for client_credentials-only clients.","commonSituations":"Registering an MCP client on an AS where the client was created with only client_credentials or refresh_token grants enabled, or a metadata document misconfigured by a gateway/proxy that rewrites grant_types_supported.","solutions":["Enable the 'authorization_code' grant for the OAuth client in the authorization server's admin settings.","Verify the metadata: curl the .well-known endpoint and confirm grant_types_supported includes 'authorization_code'.","Confirm the metadata came from the intended AS (not a proxy serving stale/mismatched discovery data).","Re-register the client so its allowed grant types match the MCP authorization code flow."],"exampleFix":"// before\n// { \"grant_types_supported\": [\"client_credentials\"] }\n// after: enable authorization_code grant on the AS client\n// { \"grant_types_supported\": [\"authorization_code\", \"refresh_token\"] }","handlingStrategy":"validation","validationCode":"if (metadata?.grant_types_supported && !metadata.grant_types_supported.includes('authorization_code')) {\n  throw new Error('Enable the authorization_code grant on the AS client before MCP auth');\n}","typeGuard":"function supportsAuthorizationCodeGrant(m: { grant_types_supported?: string[] }): boolean {\n  return !m.grant_types_supported || m.grant_types_supported.includes('authorization_code');\n}","tryCatchPattern":"try {\n  await auth(provider, { serverUrl });\n} catch (error) {\n  if (String(error.message).includes('does not support grant type')) {\n    console.error('Enable the required grant type for this client in the authorization server admin console.');\n  }\n}","preventionTips":["Enable both authorization_code and refresh_token grants when registering MCP OAuth clients.","Verify grant_types_supported in AS metadata during integration setup.","Avoid clients provisioned solely for machine-to-machine (client_credentials) grants in MCP flows."],"tags":["oauth","grant-type","mcp"],"backgroundTag":"oauth-grant-type-unsupported","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}