What causes "invalid request: response_type" in thephpleague/oauth2-server?

Add response_type=code (authorization code flow) or response_type=token (implicit flow) to the authorization request query string.

thephpleague/oauth2-server · error · OAuthServerException

invalid request: response_type

Error message

invalid request: response_type

What it means

Thrown by validateAuthorizationRequest when the authorization query string contains no 'response_type' parameter. The authorization server cannot decide between the authorization-code and implicit flows without it, so it raises an invalid_request OAuth error before any grant is matched.

Solutions

Add response_type=code (authorization code flow) or response_type=token (implicit flow) to the authorization request query string.
Verify the request reaching validateAuthorizationRequest actually preserves query params (check proxy/rewrite rules).
Ensure the client app uses the library's redirect/build logic that appends all required params.

Example fix

// before
$authUrl = 'https://auth.example.com/authorize?client_id=abc&redirect_uri=https://app/cb';
// after
$authUrl = 'https://auth.example.com/authorize?client_id=abc&redirect_uri=https://app/cb&response_type=code&state=s3t4t3';

Defensive patterns

Strategy: validation

Validate before calling

$params = $request->getQueryParams();
if (!isset($params['response_type']) || $params['response_type'] === '') {
    throw new \InvalidArgumentException('response_type query parameter is required');
}

Try / catch

try { $req = $server->validateAuthorizationRequest($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response()); }

Prevention

Always build authorize URLs from a single helper that appends response_type, client_id, redirect_uri and state
Test the authorize endpoint with a query-param contract test

When it happens

Trigger: Calling AuthorizationServer::validateAuthorizationRequest() with a PSR-7 GET request whose query params lack 'response_type' (e.g. GET /authorize?client_id=...&redirect_uri=... only).

Common situations: Frontend builds the authorize URL manually and forgets response_type; a redirect template drops the query parameter; user edits the URL; proxies stripping query strings.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of thephpleague/oauth2-server@9d2f6fc0a0 (2026-09-15). Data as JSON: /api/errors/a781945a753914ea. Report an issue: GitHub.

Appendix: source

Thrown at src/AuthorizationServer.php:117

        $grantType->setDefaultScope($this->defaultScope);
        $grantType->setPrivateKey($this->privateKey);
        $grantType->setEmitter($this->getEmitter());
        $grantType->setEncryptionKey($this->encryptionKey);
        $grantType->revokeRefreshTokens($this->revokeRefreshTokens);

        $this->enabledGrantTypes[$grantType->getIdentifier()] = $grantType;
        $this->grantTypeAccessTokenTTL[$grantType->getIdentifier()] = $accessTokenTTL;
    }

    /**
     * Validate an authorization request
     *
     * @throws OAuthServerException
     */
    public function validateAuthorizationRequest(ServerRequestInterface $request): AuthorizationRequestInterface
    {
        if (!isset($request->getQueryParams()['response_type'])) {
            throw OAuthServerException::invalidRequest('response_type');
        }

        foreach ($this->enabledGrantTypes as $grantType) {
            if ($grantType->canRespondToAuthorizationRequest($request)) {
                return $grantType->validateAuthorizationRequest($request);
            }
        }

        throw OAuthServerException::unsupportedGrantType();
    }

    /**
     * Complete an authorization request
     */
    public function completeAuthorizationRequest(
        AuthorizationRequestInterface $authRequest,
        ResponseInterface $response
    ): ResponseInterface {

View on GitHub (pinned to 9d2f6fc0a0)