{"record":{"id":"f927a9fb0d4be1d8","repo":"vercel/ai","slug":"incompatible-auth-server-does-not-support-code-ch","errorCode":null,"errorMessage":"Incompatible auth server: does not support code challenge method ${codeChallengeMethod}","messagePattern":"Incompatible auth server: does not support code challenge method (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/mcp/src/tool/oauth.ts","lineNumber":711,"sourceCode":"): Promise<{ authorizationUrl: URL; codeVerifier: string }> {\n  const responseType = 'code';\n  const codeChallengeMethod = 'S256';\n\n  let authorizationUrl: URL;\n  if (metadata) {\n    authorizationUrl = new URL(metadata.authorization_endpoint);\n\n    if (!metadata.response_types_supported.includes(responseType)) {\n      throw new Error(\n        `Incompatible auth server: does not support response type ${responseType}`,\n      );\n    }\n\n    if (\n      !metadata.code_challenge_methods_supported ||\n      !metadata.code_challenge_methods_supported.includes(codeChallengeMethod)\n    ) {\n      throw new Error(\n        `Incompatible auth server: does not support code challenge method ${codeChallengeMethod}`,\n      );\n    }\n  } else {\n    authorizationUrl = new URL('/authorize', authorizationServerUrl);\n  }\n\n  const challenge = await pkceChallenge();\n  const codeVerifier = challenge.code_verifier;\n  const codeChallenge = challenge.code_challenge;\n\n  authorizationUrl.searchParams.set('response_type', responseType);\n  authorizationUrl.searchParams.set('client_id', clientInformation.client_id);\n  authorizationUrl.searchParams.set('code_challenge', codeChallenge);\n  authorizationUrl.searchParams.set(\n    'code_challenge_method',\n    codeChallengeMethod,\n  );","sourceCodeStart":693,"sourceCodeEnd":729,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/mcp/src/tool/oauth.ts#L693-L729","documentation":"startAuthorization always uses S256 PKCE. When metadata is available, it checks code_challenge_methods_supported; if the array is missing or lacks 'S256', it throws this error because the constructed authorization URL would send code_challenge_method=S256 which the server would reject.","triggerScenarios":"Calling startAuthorization (directly or through auth()) with discovered metadata where code_challenge_methods_supported is undefined or does not include 'S256'.","commonSituations":"Legacy OAuth2 servers that support only 'plain' PKCE or no PKCE at all, IdPs behind old versions (e.g. pre-2018 Keycloak), or a misconfigured discovery document that omits the field.","solutions":["Enable S256 PKCE on the authorization server for the OAuth client being used.","Confirm via the .well-known metadata that code_challenge_methods_supported now lists 'S256'.","Upgrade the authorization server to a version supporting S256 PKCE (RFC 7636 requires S256 support).","Use a different/compliant authorization server if upgrade is impossible."],"exampleFix":"// before\n// { \"code_challenge_methods_supported\": [\"plain\"] }\n// after: set the client's PKCE code challenge method to S256 in the AS config\n// { \"code_challenge_methods_supported\": [\"S256\"] }","handlingStrategy":"validation","validationCode":"if (metadata && !(metadata.code_challenge_methods_supported ?? []).includes('S256')) {\n  throw new Error('Auth server must support S256 PKCE for MCP authorization');\n}","typeGuard":"function supportsS256Challenge(m: { code_challenge_methods_supported?: string[] }): boolean {\n  return Array.isArray(m.code_challenge_methods_supported) && m.code_challenge_methods_supported.includes('S256');\n}","tryCatchPattern":"try {\n  await startAuthorization(asUrl, { metadata, clientInformation, redirectUrl });\n} catch (error) {\n  if (String(error.message).includes('code challenge method S256')) {\n    console.error('Enable S256 PKCE on the authorization server client.');\n  }\n}","preventionTips":["Enable S256 (not plain) PKCE on every OAuth client used with MCP.","Upgrade legacy AS versions that only support plain PKCE.","Assert S256 support in a pre-deployment smoke test against the AS discovery endpoint."],"tags":["oauth","pkce","s256","mcp"],"backgroundTag":"oauth-pkce-method-unsupported","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}