siyuan-note/siyuan · error

OAuth client registration returned an unsupported token endp

Error message

OAuth client registration returned an unsupported token endpoint authentication method

What it means

Thrown at oauth.go:331-332 after a registration succeeds but the TokenEndpointAuthMethod returned (or defaulted) is not one of the three SiYuan supports (none/client_secret_post/client_secret_basic per isSupportedTokenAuthMethod). This guards against an AS assigning a stronger auth method during registration than it advertised.

Source

Thrown at kernel/mcp/client/oauth.go:332

			ResourceMetadataURL: prm.MetadataURL,
			RedirectURL:         callbackURL,
			ClientID:            registration.ClientID,
			ClientSecret:        registration.ClientSecret,
			ClientSecretExpiry:  registration.ClientSecretExpiresAt,
			TokenEndpoint:       asm.TokenEndpoint,
			RevocationEndpoint:  asm.RevocationEndpoint,
			TokenAuthMethod:     registration.TokenEndpointAuthMethod,
			Scopes:              scopes,
		}
		if registrationCredential.TokenAuthMethod == "" {
			if registration.ClientSecret == "" {
				registrationCredential.TokenAuthMethod = "none"
			} else {
				registrationCredential.TokenAuthMethod = "client_secret_basic"
			}
		}
		if !isSupportedTokenAuthMethod(registrationCredential.TokenAuthMethod) {
			return fmt.Errorf("OAuth client registration returned an unsupported token endpoint authentication method")
		}
		if err = putOAuthCredential(registrationCredential); err != nil {
			return fmt.Errorf("save OAuth client registration: %w", err)
		}
	}

	authMethod := registrationCredential.TokenAuthMethod
	if authMethod == "" {
		if registrationCredential.ClientSecret == "" {
			authMethod = "none"
		} else {
			authMethod = "client_secret_basic"
		}
	}
	config := &oauth2.Config{
		ClientID:     registrationCredential.ClientID,
		ClientSecret: registrationCredential.ClientSecret,
		RedirectURL:  callbackURL,

View on GitHub (pinned to 251596fc0d)

Solutions

1. Re-register requesting 'none' or 'client_secret_post' explicitly and confirm the AS honors the requested token_endpoint_auth_method.
2. If the AS mandates a stronger method, route through an AS or proxy that accepts none/client_secret_post/client_secret_basic.
3. Report to the AS operator if the returned method contradicts the metadata's token_endpoint_auth_methods_supported.

// After RegisterClient returns, before persisting:
method := registration.TokenEndpointAuthMethod
if method == "" {
    if registration.ClientSecret == "" { method = "none" } else { method = "client_secret_basic" }
}
if method != "none" && method != "client_secret_post" && method != "client_secret_basic" {
    return fmt.Errorf("AS assigned incompatible token auth method %q; re-register requesting none/client_secret_post", method)
}

When it happens

Trigger: RegisterClient returns a registration whose token_endpoint_auth_method is e.g. 'tls_client_auth' or 'private_key_jwt' (or the server omits a client_secret while returning a method requiring one, which then defaults incorrectly). The subsequent isSupportedTokenAuthMethod check fails.

Common situations: AS forces mTLS/JWT-bound clients regardless of requested metadata; AS bug returning a method not requested; AS assigns client_secret_basic but SiYuan's defaulting logic produced an unexpected value when secret was empty.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• OAuth authorization server does not support dynamic client r
• OAuth authorization server does not support a compatible tok
• register OAuth client: %w
• mcp oauth authorization required
• parse OAuth challenge: %w

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/40a6cd6d44034bce. Report an issue: GitHub.