{"record":{"id":"a4378c6a5a86f280","repo":"vercel/ai","slug":"incompatible-oidc-provider-at-endpointurl-does","errorCode":null,"errorMessage":"Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification","messagePattern":"Incompatible OIDC provider at (.+?): does not support S256 code challenge method required by MCP specification","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/mcp/src/tool/oauth.ts","lineNumber":664,"sourceCode":"      }\n      throw new Error(\n        `HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`,\n      );\n    }\n\n    if (type === 'oauth') {\n      const metadata = OAuthMetadataSchema.parse(await response.json());\n      assertMetadataIssuerMatches(metadata, expectedIssuer);\n      return metadata;\n    } else {\n      const metadata = OpenIdProviderDiscoveryMetadataSchema.parse(\n        await response.json(),\n      );\n      assertMetadataIssuerMatches(metadata, expectedIssuer);\n\n      // MCP spec requires OIDC providers to support S256 PKCE\n      if (!metadata.code_challenge_methods_supported?.includes('S256')) {\n        throw new Error(\n          `Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification`,\n        );\n      }\n\n      return metadata;\n    }\n  }\n\n  return undefined;\n}\n\nexport async function startAuthorization(\n  authorizationServerUrl: string | URL,\n  {\n    metadata,\n    clientInformation,\n    redirectUrl,\n    scope,","sourceCodeStart":646,"sourceCodeEnd":682,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/mcp/src/tool/oauth.ts#L646-L682","documentation":"When discovering OpenID Connect provider metadata (.well-known/openid-configuration), the MCP client requires the provider to support the S256 PKCE code challenge method, as mandated by the MCP specification. If the discovered metadata's code_challenge_methods_supported array is missing or does not include 'S256', discovery throws this error instead of returning metadata that would lead to an unusable authorization flow.","triggerScenarios":"Calling discoverAuthorizationServerMetadata against a URL whose OpenID provider discovery endpoint returns metadata lacking S256 in code_challenge_methods_supported; also reached during auth() when the authorization server is an OIDC provider.","commonSituations":"Connecting an MCP client to a legacy OIDC provider (older Keycloak versions, some enterprise IdPs) configured with only the 'plain' PKCE method, or a metadata document that omits code_challenge_methods_supported entirely even though S256 is actually supported.","solutions":["Enable/verify S256 PKCE support on the OIDC provider (e.g. Keycloak: ensure the client's PKCE method is S256) and redeploy.","Check the provider's discovery document with curl to confirm code_challenge_methods_supported includes S256 after the change.","If the IdP genuinely cannot support S256, use an OAuth-style authorization server metadata endpoint (.well-known/oauth-authorization-server) instead, or front the IdP with a proxy that advertises and implements S256.","Clear any cached metadata (the discovery result is fetched fresh each auth run) and retry the MCP connection."],"exampleFix":"// before: legacy IdP advertises only 'plain'\ncurl https://idp.example.com/.well-known/openid-configuration\n// { \"code_challenge_methods_supported\": [\"plain\"] }\n\n// after: enable S256 in the IdP client settings\ncurl https://idp.example.com/.well-known/openid-configuration\n// { \"code_challenge_methods_supported\": [\"S256\", \"plain\"] }","handlingStrategy":"validation","validationCode":"const metadata = await fetch('https://idp.example.com/.well-known/openid-configuration').then(r => r.json());\nif (!metadata.code_challenge_methods_supported?.includes('S256')) {\n  throw new Error('OIDC provider does not support S256 PKCE; fix IdP config before connecting MCP client');\n}","typeGuard":"function supportsS256(m: { code_challenge_methods_supported?: string[] }): boolean {\n  return Array.isArray(m.code_challenge_methods_supported) && m.code_challenge_methods_supported.includes('S256');\n}","tryCatchPattern":"try {\n  await connectToMcpServer(url);\n} catch (error) {\n  if (String(error.message).includes('does not support S256')) {\n    alert('Authorization server is not MCP-compatible: enable S256 PKCE on your identity provider.');\n  }\n}","preventionTips":["Check code_challenge_methods_supported in the IdP discovery document during environment setup.","Pin/upgrade to an IdP version that supports S256 PKCE (RFC 7636).","Add a CI health check that asserts S256 support for each environment's IdP."],"tags":["oauth","oidc","pkce","mcp"],"backgroundTag":"oidc-pkce-s256-unsupported","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}