{"record":{"id":"bbff901229eac6be","repo":"siyuan-note/siyuan","slug":"oauth-authorization-server-does-not-support-a-comp","errorCode":null,"errorMessage":"OAuth authorization server does not support a compatible token endpoint authentication method","messagePattern":"OAuth authorization server does not support a compatible token endpoint authentication method","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":291,"sourceCode":"\tscopes := append([]string(nil), prm.ScopesSupported...)\n\tif len(scopes) == 0 {\n\t\tscopes = append(scopes, asm.ScopesSupported...)\n\t}\n\tfor _, scope := range strings.Fields(bearerChallengeParam(challenges, \"scope\")) {\n\t\tif !slices.Contains(scopes, scope) {\n\t\t\tscopes = append(scopes, scope)\n\t\t}\n\t}\n\tregistrationCredential := credential\n\tcanReuseRegistration := hasCredential && credential.Issuer == asm.Issuer && credential.RedirectURL == callbackURL &&\n\t\tcredential.ClientID != \"\" && !oauthClientRegistrationExpired(credential) && oauthScopesContain(credential.Scopes, scopes)\n\tif !canReuseRegistration {\n\t\tif asm.RegistrationEndpoint == \"\" {\n\t\t\treturn fmt.Errorf(\"OAuth authorization server does not support dynamic client registration\")\n\t\t}\n\t\ttokenAuthMethod := preferredTokenAuthMethod(asm.TokenEndpointAuthMethodsSupported)\n\t\tif len(asm.TokenEndpointAuthMethodsSupported) > 0 && tokenAuthMethod == \"\" {\n\t\t\treturn fmt.Errorf(\"OAuth authorization server does not support a compatible token endpoint authentication method\")\n\t\t}\n\t\tgrantTypes := []string{\"authorization_code\"}\n\t\tif len(asm.GrantTypesSupported) == 0 || slices.Contains(asm.GrantTypesSupported, \"refresh_token\") {\n\t\t\tgrantTypes = append(grantTypes, \"refresh_token\")\n\t\t}\n\t\tregistration, registerErr := oauthex.RegisterClient(ctx, asm.RegistrationEndpoint, &oauthex.ClientRegistrationMetadata{\n\t\t\tRedirectURIs:            []string{callbackURL},\n\t\t\tTokenEndpointAuthMethod: tokenAuthMethod,\n\t\t\tGrantTypes:              grantTypes,\n\t\t\tResponseTypes:           []string{\"code\"},\n\t\t\tClientName:              \"SiYuan\",\n\t\t\tScope:                   strings.Join(scopes, \" \"),\n\t\t\tApplicationType:         \"native\",\n\t\t}, h.client)\n\t\tif registerErr != nil {\n\t\t\treturn fmt.Errorf(\"register OAuth client: %w\", registerErr)\n\t\t}\n\t\tregistrationCredential = oauthCredential{","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L273-L309","documentation":"Thrown at oauth.go:290-291 when asm.TokenEndpointAuthMethodsSupported is non-empty and none of SiYuan's supported methods ('none', 'client_secret_post', 'client_secret_basic' per preferredTokenAuthMethod) are present. SiYuan cannot authenticate to the token endpoint with stronger methods like tls_client_auth or private_key_jwt.","triggerScenarios":"Interactive Authorize where registration is needed and the AS advertises token_endpoint_auth_methods_supported containing only entries such as ['tls_client_auth','private_key_jwt'] or ['client_secret_jwt']. Empty/absent field skips this check.","commonSituations":"Hardened enterprise AS enforcing mTLS or JWT-bound clients; FAPI-compliant servers; misconfigured AS that omits the basic methods from the list.","solutions":["Add 'none', 'client_secret_post', or 'client_secret_basic' to token_endpoint_auth_methods_supported on the AS.","If the AS intentionally requires mTLS/JWT, route SiYuan through a different AS or proxy that accepts a basic auth method.","Verify the metadata document is the correct one for the resource (a stale mirror may show stricter methods)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"supported := asm.TokenEndpointAuthMethodsSupported\nok := len(supported) == 0 ||\n    slices.Contains(supported, \"none\") ||\n    slices.Contains(supported, \"client_secret_post\") ||\n    slices.Contains(supported, \"client_secret_basic\")\nif !ok {\n    return fmt.Errorf(\"AS token endpoint must accept none/client_secret_post/client_secret_basic\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Review token_endpoint_auth_methods_supported at onboarding.","Avoid AS deployments that enforce mTLS/JWT-only client auth for native apps."],"tags":["oauth","mcp","token-auth","metadata","authorization-server"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}