nextauthjs/next-auth · info

token_type is 'bearer'. Redundant workaround, please open an

Error message

token_type is 'bearer'. Redundant workaround, please open an issue.

What it means

The WeChat provider's token endpoint conform() rewrites token_type to 'bearer' because WeChat returns a nonstandard value. This console.warn fires when WeChat's response already has token_type === 'bearer', meaning the normalization workaround is no longer needed. The provider author asks users to report it so the workaround can be removed.

Source

Thrown at packages/core/src/providers/wechat.ts:110

      url:
        platformType === "OfficialAccount"
          ? "https://open.weixin.qq.com/connect/oauth2/authorize"
          : "https://open.weixin.qq.com/connect/qrconnect",
      params: {
        appid: clientId,
        scope:
          platformType === "OfficialAccount"
            ? "snsapi_userinfo"
            : "snsapi_login",
      },
    },
    token: {
      url: "https://api.weixin.qq.com/sns/oauth2/access_token",
      params: { appid: clientId, secret: clientSecret },
      async conform(response) {
        const data = await response.json()
        if (data.token_type === "bearer") {
          console.warn(
            "token_type is 'bearer'. Redundant workaround, please open an issue."
          )
          return response
        }
        return Response.json({ ...data, token_type: "bearer" }, response)
      },
    },
    userinfo: {
      url: "https://api.weixin.qq.com/sns/userinfo",
      async request({ tokens, provider }) {
        if (!provider.userinfo) return

        const url = new URL(provider.userinfo.url)
        url.searchParams.set("access_token", tokens.access_token!)
        url.searchParams.set("openid", String(tokens.openid))
        url.searchParams.set("lang", "zh_CN")
        const response = await fetch(url)
        return response.json()

View on GitHub (pinned to a1a16a5a77)

Solutions

1. No action required — the response is passed through unchanged and sign-in works
2. Verify the OAuth flow completes and token_type is consumed correctly by your provider chain
3. Report the change to the Auth.js maintainers (open an issue) so the WeChat conform() workaround can be dropped

When it happens

Trigger: Exchanging a WeChat OAuth code via https://api.weixin.qq.com/sns/oauth2/access_token when the API response includes token_type === 'bearer' (instead of the historically lowercase/missing value the workaround targets).

Common situations: WeChat changing their OAuth API response format; new WeChat app types that already comply with the OAuth spec; developers noticing the warning after upgrading the SDK while the underlying API updated.

Related errors

• Missing or invalid provider account
• Provider not supported
• Account not created
• The account is already associated with another user
• Another account already exists with the same e-mail address

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/c7df6c831d87d855. Report an issue: GitHub.