karatelabs/karate · error · IllegalArgumentException

Unsupported PKCE method:

Error message

Unsupported PKCE method: 

What it means

PkceGenerator.generateCodeChallenge only supports the "S256" PKCE transformation; any other method value is rejected with this IllegalArgumentException. RFC 7636 defines "plain" and "S256", and this implementation intentionally only implements S256. The method string is interpolated into the message.

Solutions

1. Pass exactly "S256" (case-sensitive) as the PKCE method.
2. If the auth server only supports "plain", compute the challenge yourself (verifier is the challenge) instead of using PkceGenerator.
3. Check the configured value comes from config/environment and normalize it (trim, uppercase) before calling.
4. Null-check the method before calling if it is externally supplied.

Example fix

// before
String challenge = PkceGenerator.challenge(verifier, "plain");
// after
String challenge = PkceGenerator.challenge(verifier, "S256");

// Java
if (!"S256".equals(method)) throw new IllegalArgumentException("Only S256 PKCE is supported, got: " + method);

When it happens

Trigger: Calling PkceGenerator.challenge(verifier, method) with method != "S256" — e.g. "plain", "s256" (wrong case), null, or a typo like "S-256".

Common situations: Configuring an OAuth2 client copied from a legacy example that used the deprecated "plain" method; passing a method value from external config with different casing; hand-written PKCE setup code guessing the method name.

Related errors

• Authorization flow failed: " + e.getMessage()
• Failed to generate code challenge
• start() argument must be a string path or config map
• Missing 'authorizationUrl' in OAuth config
• Missing 'client_id' in OAuth config

AI-assisted analysis of karatelabs/karate@a22eb90246 (2026-09-12). Data as JSON: /api/errors/eb1c92f71b7dd8cf. Report an issue: GitHub.

Appendix: source

Thrown at karate-core/src/main/java/io/karatelabs/http/PkceGenerator.java:67

    }

    /**
     * Generate code challenge from verifier
     */
    private static String generateCodeChallenge(String verifier, String method) {
        if ("plain".equals(method)) {
            return verifier;
        }
        if ("S256".equals(method)) {
            try {
                MessageDigest digest = MessageDigest.getInstance("SHA-256");
                byte[] hash = digest.digest(verifier.getBytes(StandardCharsets.US_ASCII));
                return base64UrlEncode(hash);
            } catch (Exception e) {
                throw new OAuth2Exception("Failed to generate code challenge", e);
            }
        }
        throw new IllegalArgumentException("Unsupported PKCE method: " + method);
    }

    /**
     * Base64-URL encoding without padding
     */
    private static String base64UrlEncode(byte[] data) {
        return Base64.getUrlEncoder()
            .withoutPadding()
            .encodeToString(data);
    }

    public String getVerifier() { return verifier; }
    public String getChallenge() { return challenge; }
    public String getMethod() { return method; }
}

View on GitHub (pinned to a22eb90246)