siyuan-note/siyuan · error

register OAuth client: %w

Error message

register OAuth client: %w

What it means

Wrapped error returned at oauth.go:306-307 when oauthex.RegisterClient fails during RFC 7591 dynamic client registration. The underlying error comes from the registration_endpoint HTTP call — network failure, non-2xx response, or a malformed registration response that could not be parsed.

Source

Thrown at kernel/mcp/client/oauth.go:307

		tokenAuthMethod := preferredTokenAuthMethod(asm.TokenEndpointAuthMethodsSupported)
		if len(asm.TokenEndpointAuthMethodsSupported) > 0 && tokenAuthMethod == "" {
			return fmt.Errorf("OAuth authorization server does not support a compatible token endpoint authentication method")
		}
		grantTypes := []string{"authorization_code"}
		if len(asm.GrantTypesSupported) == 0 || slices.Contains(asm.GrantTypesSupported, "refresh_token") {
			grantTypes = append(grantTypes, "refresh_token")
		}
		registration, registerErr := oauthex.RegisterClient(ctx, asm.RegistrationEndpoint, &oauthex.ClientRegistrationMetadata{
			RedirectURIs:            []string{callbackURL},
			TokenEndpointAuthMethod: tokenAuthMethod,
			GrantTypes:              grantTypes,
			ResponseTypes:           []string{"code"},
			ClientName:              "SiYuan",
			Scope:                   strings.Join(scopes, " "),
			ApplicationType:         "native",
		}, h.client)
		if registerErr != nil {
			return fmt.Errorf("register OAuth client: %w", registerErr)
		}
		registrationCredential = oauthCredential{
			ServerID:            h.server.ID,
			Endpoint:            h.server.URL,
			Resource:            prm.Resource,
			Issuer:              asm.Issuer,
			ResourceMetadataURL: prm.MetadataURL,
			RedirectURL:         callbackURL,
			ClientID:            registration.ClientID,
			ClientSecret:        registration.ClientSecret,
			ClientSecretExpiry:  registration.ClientSecretExpiresAt,
			TokenEndpoint:       asm.TokenEndpoint,
			RevocationEndpoint:  asm.RevocationEndpoint,
			TokenAuthMethod:     registration.TokenEndpointAuthMethod,
			Scopes:              scopes,
		}
		if registrationCredential.TokenAuthMethod == "" {
			if registration.ClientSecret == "" {

View on GitHub (pinned to 251596fc0d)

Solutions

1. Inspect the wrapped error text (the %w chain carries the HTTP status/body from RegisterClient) to identify the registration_endpoint's rejection reason.
2. Ensure the SiYuan kernel port (util.ServerPort) matches the callback and that the AS permits http://127.0.0.1:<port>/... redirect URIs.
3. Verify scopes requested (prm.ScopesSupported + asm.ScopesSupported + bearer challenge scope) are all permitted by the AS DCR policy.
4. Check network reachability to the registration_endpoint URL (proxy, TLS, firewall).

registration, registerErr := oauthex.RegisterClient(ctx, asm.RegistrationEndpoint, meta, h.client)
if registerErr != nil {
    // Error 325 path — log the underlying HTTP detail and surface to runtime state.
    logging.LogWarnf("mcp oauth: DCR failed against %s: %s", asm.RegistrationEndpoint, registerErr)
    setMCPRuntimeStateForContext(ctx, h.server.ID, "authorization_required", 0, registerErr.Error(), "")
    return fmt.Errorf("register OAuth client: %w", registerErr)
}

When it happens

Trigger: POST to asm.RegistrationEndpoint with ClientRegistrationMetadata (redirect URIs, grant types, client name 'SiYuan') returns 4xx (e.g. invalid_redirect_uri, invalid_client_metadata) or 5xx, the connection fails, or the response body is not valid registration JSON.

Common situations: Redirect URI rejected (port differs from util.ServerPort, or AS requires HTTPS); requested scopes rejected by AS policy; registration endpoint behind a firewall/unreachable; AS DCR implementation returns a non-conformant body; client_secret_expires_at or other field rejected.

Related errors

• OAuth authorization server does not support dynamic client r
• discover OAuth authorization server: %w
• OAuth client registration returned an unsupported token endp
• OAuth protected resource metadata not found
• OAuth token endpoint returned %s

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/4f537c3b56f133ba. Report an issue: GitHub.