thephpleague/oauth2-server · error · OAuthServerException

unsupported grant type

Error message

unsupported grant type

What it means

Thrown by validateAuthorizationRequest when the request has a response_type but none of the registered grant types can respond to the authorization request. Usually means no authorization-code grant is enabled on the server or the request is malformed for that grant.

Solutions

1. Enable the authorization code grant: $server->enableGrantType(new AuthCodeGrant($authCodeRepo, $refreshTokenRepo, new DateInterval('PT10M'))).
2. Check response_type matches a grant that supports authorization requests (code/token, not client_credentials).
3. Confirm $this->enabledGrantTypes is populated before handling /authorize.

Example fix

// before
$server->enableGrantType(new ClientCredentialsGrant());
// after
$server->enableGrantType(new ClientCredentialsGrant());
$server->enableGrantType(new AuthCodeGrant($authCodeRepository, $refreshTokenRepository, new \DateInterval('PT10M')));

$hasAuthCodeGrant = false;
foreach ($grants as $g) { if ($g instanceof AuthCodeGrant) { $hasAuthCodeGrant = true; } }
if (!$hasAuthCodeGrant) throw new \RuntimeException('No grant enabled for /authorize');

try { $req = $server->validateAuthorizationRequest($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response()); }

When it happens

Trigger: AuthorizationServer->enableGrantType() was never called with an AuthCodeGrant (or the one enabled doesn't match the request), yet validateAuthorizationRequest() is invoked with response_type=code.

Common situations: Server only configured with client_credentials/password grants but an authorize endpoint is hit; typo in response_type; client sends response_type the enabled grants don't handle.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• invalid request: response_type
• Missing "Authorization" header
• Missing "Bearer" token
• Access token could not be verified
• Access token is not an instance of UnencryptedToken

AI-assisted analysis of thephpleague/oauth2-server@9d2f6fc0a0 (2026-09-15). Data as JSON: /api/errors/2baa5d93fb637542. Report an issue: GitHub.

Appendix: source

Thrown at src/AuthorizationServer.php:126

    /**
     * Validate an authorization request
     *
     * @throws OAuthServerException
     */
    public function validateAuthorizationRequest(ServerRequestInterface $request): AuthorizationRequestInterface
    {
        if (!isset($request->getQueryParams()['response_type'])) {
            throw OAuthServerException::invalidRequest('response_type');
        }

        foreach ($this->enabledGrantTypes as $grantType) {
            if ($grantType->canRespondToAuthorizationRequest($request)) {
                return $grantType->validateAuthorizationRequest($request);
            }
        }

        throw OAuthServerException::unsupportedGrantType();
    }

    /**
     * Complete an authorization request
     */
    public function completeAuthorizationRequest(
        AuthorizationRequestInterface $authRequest,
        ResponseInterface $response
    ): ResponseInterface {
        return $this->enabledGrantTypes[$authRequest->getGrantTypeId()]
            ->completeAuthorizationRequest($authRequest)
            ->generateHttpResponse($response);
    }

    /**
     * Respond to device authorization request
     *
     * @throws OAuthServerException

View on GitHub (pinned to 9d2f6fc0a0)