OAuth authorization server does not support a compatible tok

Error message

OAuth authorization server does not support a compatible token endpoint authentication method

What it means

Thrown at oauth.go:290-291 when asm.TokenEndpointAuthMethodsSupported is non-empty and none of SiYuan's supported methods ('none', 'client_secret_post', 'client_secret_basic' per preferredTokenAuthMethod) are present. SiYuan cannot authenticate to the token endpoint with stronger methods like tls_client_auth or private_key_jwt.

Source

Thrown at kernel/mcp/client/oauth.go:291

	scopes := append([]string(nil), prm.ScopesSupported...)
	if len(scopes) == 0 {
		scopes = append(scopes, asm.ScopesSupported...)
	}
	for _, scope := range strings.Fields(bearerChallengeParam(challenges, "scope")) {
		if !slices.Contains(scopes, scope) {
			scopes = append(scopes, scope)
		}
	}
	registrationCredential := credential
	canReuseRegistration := hasCredential && credential.Issuer == asm.Issuer && credential.RedirectURL == callbackURL &&
		credential.ClientID != "" && !oauthClientRegistrationExpired(credential) && oauthScopesContain(credential.Scopes, scopes)
	if !canReuseRegistration {
		if asm.RegistrationEndpoint == "" {
			return fmt.Errorf("OAuth authorization server does not support dynamic client registration")
		}
		tokenAuthMethod := preferredTokenAuthMethod(asm.TokenEndpointAuthMethodsSupported)
		if len(asm.TokenEndpointAuthMethodsSupported) > 0 && tokenAuthMethod == "" {
			return fmt.Errorf("OAuth authorization server does not support a compatible token endpoint authentication method")
		}
		grantTypes := []string{"authorization_code"}
		if len(asm.GrantTypesSupported) == 0 || slices.Contains(asm.GrantTypesSupported, "refresh_token") {
			grantTypes = append(grantTypes, "refresh_token")
		}
		registration, registerErr := oauthex.RegisterClient(ctx, asm.RegistrationEndpoint, &oauthex.ClientRegistrationMetadata{
			RedirectURIs:            []string{callbackURL},
			TokenEndpointAuthMethod: tokenAuthMethod,
			GrantTypes:              grantTypes,
			ResponseTypes:           []string{"code"},
			ClientName:              "SiYuan",
			Scope:                   strings.Join(scopes, " "),
			ApplicationType:         "native",
		}, h.client)
		if registerErr != nil {
			return fmt.Errorf("register OAuth client: %w", registerErr)
		}
		registrationCredential = oauthCredential{

View on GitHub (pinned to 251596fc0d)

Solutions

Add 'none', 'client_secret_post', or 'client_secret_basic' to token_endpoint_auth_methods_supported on the AS.
If the AS intentionally requires mTLS/JWT, route SiYuan through a different AS or proxy that accepts a basic auth method.
Verify the metadata document is the correct one for the resource (a stale mirror may show stricter methods).

Defensive patterns

Strategy: validation

Validate before calling

supported := asm.TokenEndpointAuthMethodsSupported
ok := len(supported) == 0 ||
    slices.Contains(supported, "none") ||
    slices.Contains(supported, "client_secret_post") ||
    slices.Contains(supported, "client_secret_basic")
if !ok {
    return fmt.Errorf("AS token endpoint must accept none/client_secret_post/client_secret_basic")
}

Prevention

Review token_endpoint_auth_methods_supported at onboarding.
Avoid AS deployments that enforce mTLS/JWT-only client auth for native apps.

When it happens

Trigger: Interactive Authorize where registration is needed and the AS advertises token_endpoint_auth_methods_supported containing only entries such as ['tls_client_auth','private_key_jwt'] or ['client_secret_jwt']. Empty/absent field skips this check.

Common situations: Hardened enterprise AS enforcing mTLS or JWT-bound clients; FAPI-compliant servers; misconfigured AS that omits the basic methods from the list.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/bbff901229eac6be. Report an issue: GitHub.