{"record":{"id":"e6eb0b4fba09747e","repo":"siyuan-note/siyuan","slug":"oauth-authorization-server-does-not-support-the-au","errorCode":null,"errorMessage":"OAuth authorization server does not support the authorization code response type","messagePattern":"OAuth authorization server does not support the authorization code response type","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":255,"sourceCode":"\t\tif !permanent {\n\t\t\treturn fmt.Errorf(\"refresh OAuth credentials: %w\", refreshErr)\n\t\t}\n\t\tcredential.AccessToken = \"\"\n\t\tcredential.RefreshToken = \"\"\n\t\tcredential.Expiry = time.Time{}\n\t\tif saveErr := putOAuthCredential(credential); saveErr != nil {\n\t\t\tlogging.LogWarnf(\"mcp oauth: clear invalid credentials failed: %s\", saveErr)\n\t\t}\n\t}\n\tif !interactive {\n\t\tsetMCPRuntimeStateForContext(ctx, h.server.ID, \"authorization_required\", 0, \"\", \"\")\n\t\treturn errOAuthAuthorizationRequired\n\t}\n\tif !slices.Contains(asm.CodeChallengeMethodsSupported, \"S256\") {\n\t\treturn fmt.Errorf(\"OAuth authorization server does not support PKCE S256\")\n\t}\n\tif len(asm.ResponseTypesSupported) > 0 && !slices.Contains(asm.ResponseTypesSupported, \"code\") {\n\t\treturn fmt.Errorf(\"OAuth authorization server does not support the authorization code response type\")\n\t}\n\tif len(asm.GrantTypesSupported) > 0 && !slices.Contains(asm.GrantTypesSupported, \"authorization_code\") {\n\t\treturn fmt.Errorf(\"OAuth authorization server does not support the authorization code grant\")\n\t}\n\n\tflowID := reusableOAuthFlowID(credential)\n\tif flowID == \"\" {\n\t\tflowID, err = secureRandomString(24)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tstate, err := secureRandomString(24)\n\tif err != nil {\n\t\treturn err\n\t}\n\tcallbackURL := fmt.Sprintf(\"http://127.0.0.1:%s/api/ai/mcp/oauth/callback/%s\", util.ServerPort, flowID)\n\tscopes := append([]string(nil), prm.ScopesSupported...)","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L237-L273","documentation":"Thrown at oauth.go:254-255 when the AS metadata includes a non-empty response_types_supported array but it does not contain 'code'. SiYuan only performs the authorization-code flow, so a server advertising only implicit/hybrid/etc. is rejected before launching the browser flow.","triggerScenarios":"Interactive Authorize against an AS whose metadata has response_types_supported = ['token'] or ['id_token'] or ['code token'] (without a bare 'code' entry). The check is skipped only if the field is empty/absent.","commonSituations":"Server configured purely for SPA implicit flow; a server that lists compound response types but not the plain 'code' value; mispublished metadata.","solutions":["Add 'code' to response_types_supported on the authorization server.","If the AS only supports implicit, reconfigure it for the authorization-code grant (the recommended modern flow) or pick a compliant AS.","Verify the issuer URL resolves to the correct AS metadata document (a wrong resource can select the wrong AS)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"asm, err := auth.GetAuthServerMetadata(ctx, issuerURL, http.DefaultClient)\nif err != nil { return err }\nif len(asm.ResponseTypesSupported) > 0 && !slices.Contains(asm.ResponseTypesSupported, \"code\") {\n    return fmt.Errorf(\"AS must support the 'code' response_type\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate response_types_supported during AS onboarding.","Prefer AS configurations that advertise the authorization-code flow for native apps."],"tags":["oauth","mcp","response-type","metadata","authorization-server"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}