What causes "Unknown PKCE code challenge method." in git-ecosystem/git-credential-manager?

Use only the supported PKCE methods, typically S256 (and 'plain' if supported by this build)

git-ecosystem/git-credential-manager · error · ArgumentOutOfRangeException

Unknown PKCE code challenge method.

Error message

Unknown PKCE code challenge method.

What it means

The OAuth2CryptographicGenerator throws ArgumentOutOfRangeException when asked to create a PKCE code challenge with a code_challenge_method it does not implement. The switch over the challenge method enum has no handler for the given value, so generation cannot proceed safely and the library refuses rather than producing a non-compliant challenge.

Solutions

Use only the supported PKCE methods, typically S256 (and 'plain' if supported by this build)
Validate the challengeMethod value before calling CreatePkceCodeChallenge
If parsing the method from config/wire input, reject unknown values early with a clear error
Update the library if you need a newer PKCE method that the current generator lacks

Example fix

// before
var challenge = generator.CreatePkceCodeChallenge((PKCEChallengeMethod)5, verifier);
// after
var method = PKCEChallengeMethod.S256; // supported value
var challenge = generator.CreatePkceCodeChallenge(method, verifier);

Defensive patterns

Strategy: validation

Validate before calling

if (!Enum.IsDefined(typeof(PKCEChallengeMethod), challengeMethod)) throw new ArgumentException($"Unsupported PKCE method: {challengeMethod}", nameof(challengeMethod));

Type guard

bool IsSupportedPkceMethod(PKCEChallengeMethod m) => m == PKCEChallengeMethod.S256;

Try / catch

try { challenge = generator.CreatePkceCodeChallenge(method, verifier); } catch (ArgumentOutOfRangeException) { challenge = generator.CreatePkceCodeChallenge(PKCEChallengeMethod.S256, verifier); }

Prevention

Only use enum members the generator documents as supported (S256)
Never cast ints/strings to the method enum without Enum.IsDefined/TryParse
Add unit tests covering every enum member passed to CreatePkceCodeChallenge

When it happens

Trigger: Calling CreatePkceCodeChallenge (directly or via the challenge/actualChallenge code paths) with a PKCEChallengeMethod value outside the supported set (e.g. an undefined enum cast, or a method parsed from an unexpected 'code_challenge_method' wire value).

Common situations: Constructing the enum from an int or string without validation; a library upgrade adding a new PKCE method that a caller forwards before the generator supports it; tests probing enum boundaries.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/a0984b8dd8514335. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/OAuth/OAuth2CryptographicGenerator.cs:98

                case OAuth2PkceChallengeMethod.Plain:
                    return codeVerifier;

                case OAuth2PkceChallengeMethod.Sha256:
                    // The "S256" code challenge is computed as follows, per RFC 7636:
                    //
                    //   code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier)))
                    //
                    using (var sha256 = SHA256.Create())
                    {
                        return Base64Url.EncodeToString(
                            sha256.ComputeHash(
                                Encoding.ASCII.GetBytes(codeVerifier)
                            )
                        );
                    }

                default:
                    throw new ArgumentOutOfRangeException(nameof(challengeMethod), challengeMethod, "Unknown PKCE code challenge method.");
            }
        }
    }
}

View on GitHub (pinned to e8ce762cd0)