{"record":{"id":"c00dd3e5f79a7256","repo":"spring-projects/spring-security","slug":"server-error-c00dd3","errorCode":"SERVER_ERROR","errorMessage":"The token generator failed to generate the access token.","messagePattern":"The token generator failed to generate the access token\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java","lineNumber":224,"sourceCode":"\t\t\t\t.authorizationServerContext(AuthorizationServerContextHolder.getContext())\n\t\t\t\t.authorization(authorization)\n\t\t\t\t.authorizedScopes(authorization.getAuthorizedScopes())\n\t\t\t\t.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)\n\t\t\t\t.authorizationGrant(authorizationCodeAuthentication);\n\t\t// @formatter:on\n\t\tif (dPoPProof != null) {\n\t\t\ttokenContextBuilder.put(OAuth2TokenContext.DPOP_PROOF_KEY, dPoPProof);\n\t\t}\n\n\t\tOAuth2Authorization.Builder authorizationBuilder = OAuth2Authorization.from(authorization);\n\n\t\t// ----- Access token -----\n\t\tOAuth2TokenContext tokenContext = tokenContextBuilder.tokenType(OAuth2TokenType.ACCESS_TOKEN).build();\n\t\tOAuth2Token generatedAccessToken = this.tokenGenerator.generate(tokenContext);\n\t\tif (generatedAccessToken == null) {\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"The token generator failed to generate the access token.\", ERROR_URI);\n\t\t\tthrow new OAuth2AuthenticationException(error);\n\t\t}\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Generated access token\");\n\t\t}\n\n\t\tOAuth2AccessToken accessToken = OAuth2AuthenticationProviderUtils.accessToken(authorizationBuilder,\n\t\t\t\tgeneratedAccessToken, tokenContext);\n\n\t\t// ----- Refresh token -----\n\t\tOAuth2RefreshToken refreshToken = null;\n\t\t// Do not issue refresh token to public client\n\t\tif (registeredClient.getAuthorizationGrantTypes().contains(AuthorizationGrantType.REFRESH_TOKEN)) {\n\t\t\ttokenContext = tokenContextBuilder.tokenType(OAuth2TokenType.REFRESH_TOKEN).build();\n\t\t\tOAuth2Token generatedRefreshToken = this.tokenGenerator.generate(tokenContext);\n\t\t\tif (generatedRefreshToken != null) {\n\t\t\t\tif (!(generatedRefreshToken instanceof OAuth2RefreshToken)) {\n\t\t\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java#L206-L242","documentation":"In OAuth2AuthorizationCodeAuthenticationProvider.authenticate, after validating the authorization code grant, the configured OAuth2TokenGenerator is asked to produce an access token for the token context. If generate() returns null — meaning no generator in the composite supports this context — the provider throws this SERVER_ERROR OAuth2AuthenticationException.","triggerScenarios":"Calling the token endpoint with an authorization_code grant while the authorization server's OAuth2TokenGenerator bean produces no access token for the context (e.g. a custom generator that returns null, or a generator configured without any matching encoder).","commonSituations":"Overriding the default token generator bean with a partial one; registering only a JwtGenerator without matching settings, or only an OAuth2AccessTokenGenerator while JWT format is required; misconfigured HttpMessageConverter/encoder beans after customization.","solutions":["Use OAuth2AccessTokenGenerator or the composite created by OAuth2ConfigurerUtils.getTokenGenerator(...) so the generator chain covers the context.","If using a custom OAuth2TokenGenerator, ensure its generate(context) returns a non-null token for ACCESS_TOKEN contexts or delegates to a next generator.","Check that token settings (access-token format JWT vs reference) match the generators registered.","Revert to the default DSL configuration if you recently customized token generation."],"exampleFix":"// before\n@Bean\nOAuth2TokenGenerator<?> tokenGenerator() {\n    return new MyNarrowGenerator(); // returns null for JWT contexts\n}\n\n// after\n@Bean\nOAuth2TokenGenerator<?> tokenGenerator(JWKSource<SecurityContext> jwkSource) {\n    JwtGenerator jwtGenerator = new JwtGenerator(new NimbusJwtEncoder(jwkSource));\n    return new DelegatingOAuth2TokenGenerator(jwtGenerator, new OAuth2AccessTokenGenerator());\n}","handlingStrategy":"try-catch","validationCode":"// At startup, smoke-test the generator\nOAuth2Token t = tokenGenerator.generate(new OAuth2TokenContext() {});\nassert t != null : \"OAuth2TokenGenerator must produce tokens for access token contexts\";","typeGuard":null,"tryCatchPattern":"try {\n    // call /oauth2/token with authorization_code grant\n} catch (OAuth2AuthenticationException ex) {\n    if (OAuth2ErrorCodes.SERVER_ERROR.equals(ex.getError().getErrorCode())\n        && ex.getError().getDescription().contains(\"access token\")) {\n        log.error(\"Token generator misconfigured: no generator produced an access token\");\n    }\n    throw ex;\n}","preventionTips":["Keep the default OAuth2TokenGenerator from OAuth2ConfigurerUtils unless you must customize","If customizing, use DelegatingOAuth2TokenGenerator with JwtGenerator + OAuth2AccessTokenGenerator","Add a boot-time integration test exercising the full authorization_code token issuance"],"tags":["oauth2","token-generation","server-error"],"backgroundTag":"missing-configuration","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}