OAuth authorization server does not support the authorizatio

Error message

OAuth authorization server does not support the authorization code response type

What it means

Thrown at oauth.go:254-255 when the AS metadata includes a non-empty response_types_supported array but it does not contain 'code'. SiYuan only performs the authorization-code flow, so a server advertising only implicit/hybrid/etc. is rejected before launching the browser flow.

Source

Thrown at kernel/mcp/client/oauth.go:255

		if !permanent {
			return fmt.Errorf("refresh OAuth credentials: %w", refreshErr)
		}
		credential.AccessToken = ""
		credential.RefreshToken = ""
		credential.Expiry = time.Time{}
		if saveErr := putOAuthCredential(credential); saveErr != nil {
			logging.LogWarnf("mcp oauth: clear invalid credentials failed: %s", saveErr)
		}
	}
	if !interactive {
		setMCPRuntimeStateForContext(ctx, h.server.ID, "authorization_required", 0, "", "")
		return errOAuthAuthorizationRequired
	}
	if !slices.Contains(asm.CodeChallengeMethodsSupported, "S256") {
		return fmt.Errorf("OAuth authorization server does not support PKCE S256")
	}
	if len(asm.ResponseTypesSupported) > 0 && !slices.Contains(asm.ResponseTypesSupported, "code") {
		return fmt.Errorf("OAuth authorization server does not support the authorization code response type")
	}
	if len(asm.GrantTypesSupported) > 0 && !slices.Contains(asm.GrantTypesSupported, "authorization_code") {
		return fmt.Errorf("OAuth authorization server does not support the authorization code grant")
	}

	flowID := reusableOAuthFlowID(credential)
	if flowID == "" {
		flowID, err = secureRandomString(24)
		if err != nil {
			return err
		}
	}
	state, err := secureRandomString(24)
	if err != nil {
		return err
	}
	callbackURL := fmt.Sprintf("http://127.0.0.1:%s/api/ai/mcp/oauth/callback/%s", util.ServerPort, flowID)
	scopes := append([]string(nil), prm.ScopesSupported...)

View on GitHub (pinned to 251596fc0d)

Solutions

Add 'code' to response_types_supported on the authorization server.
If the AS only supports implicit, reconfigure it for the authorization-code grant (the recommended modern flow) or pick a compliant AS.
Verify the issuer URL resolves to the correct AS metadata document (a wrong resource can select the wrong AS).

Defensive patterns

Strategy: validation

Validate before calling

asm, err := auth.GetAuthServerMetadata(ctx, issuerURL, http.DefaultClient)
if err != nil { return err }
if len(asm.ResponseTypesSupported) > 0 && !slices.Contains(asm.ResponseTypesSupported, "code") {
    return fmt.Errorf("AS must support the 'code' response_type")
}

Prevention

Validate response_types_supported during AS onboarding.
Prefer AS configurations that advertise the authorization-code flow for native apps.

When it happens

Trigger: Interactive Authorize against an AS whose metadata has response_types_supported = ['token'] or ['id_token'] or ['code token'] (without a bare 'code' entry). The check is skipped only if the field is empty/absent.

Common situations: Server configured purely for SPA implicit flow; a server that lists compound response types but not the plain 'code' value; mispublished metadata.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/e6eb0b4fba09747e. Report an issue: GitHub.