vercel/ai · error

Incompatible auth server: does not support code challenge me

Error message

Incompatible auth server: does not support code challenge method ${codeChallengeMethod}

What it means

startAuthorization always uses S256 PKCE. When metadata is available, it checks code_challenge_methods_supported; if the array is missing or lacks 'S256', it throws this error because the constructed authorization URL would send code_challenge_method=S256 which the server would reject.

Source

Thrown at packages/mcp/src/tool/oauth.ts:711

): Promise<{ authorizationUrl: URL; codeVerifier: string }> {
  const responseType = 'code';
  const codeChallengeMethod = 'S256';

  let authorizationUrl: URL;
  if (metadata) {
    authorizationUrl = new URL(metadata.authorization_endpoint);

    if (!metadata.response_types_supported.includes(responseType)) {
      throw new Error(
        `Incompatible auth server: does not support response type ${responseType}`,
      );
    }

    if (
      !metadata.code_challenge_methods_supported ||
      !metadata.code_challenge_methods_supported.includes(codeChallengeMethod)
    ) {
      throw new Error(
        `Incompatible auth server: does not support code challenge method ${codeChallengeMethod}`,
      );
    }
  } else {
    authorizationUrl = new URL('/authorize', authorizationServerUrl);
  }

  const challenge = await pkceChallenge();
  const codeVerifier = challenge.code_verifier;
  const codeChallenge = challenge.code_challenge;

  authorizationUrl.searchParams.set('response_type', responseType);
  authorizationUrl.searchParams.set('client_id', clientInformation.client_id);
  authorizationUrl.searchParams.set('code_challenge', codeChallenge);
  authorizationUrl.searchParams.set(
    'code_challenge_method',
    codeChallengeMethod,
  );

View on GitHub (pinned to 69428b1f8b)

Solutions

1. Enable S256 PKCE on the authorization server for the OAuth client being used.
2. Confirm via the .well-known metadata that code_challenge_methods_supported now lists 'S256'.
3. Upgrade the authorization server to a version supporting S256 PKCE (RFC 7636 requires S256 support).
4. Use a different/compliant authorization server if upgrade is impossible.

Example fix

// before
// { "code_challenge_methods_supported": ["plain"] }
// after: set the client's PKCE code challenge method to S256 in the AS config
// { "code_challenge_methods_supported": ["S256"] }

if (metadata && !(metadata.code_challenge_methods_supported ?? []).includes('S256')) {
  throw new Error('Auth server must support S256 PKCE for MCP authorization');
}

function supportsS256Challenge(m: { code_challenge_methods_supported?: string[] }): boolean {
  return Array.isArray(m.code_challenge_methods_supported) && m.code_challenge_methods_supported.includes('S256');
}

try {
  await startAuthorization(asUrl, { metadata, clientInformation, redirectUrl });
} catch (error) {
  if (String(error.message).includes('code challenge method S256')) {
    console.error('Enable S256 PKCE on the authorization server client.');
  }
}

When it happens

Trigger: Calling startAuthorization (directly or through auth()) with discovered metadata where code_challenge_methods_supported is undefined or does not include 'S256'.

Common situations: Legacy OAuth2 servers that support only 'plain' PKCE or no PKCE at all, IdPs behind old versions (e.g. pre-2018 Keycloak), or a misconfigured discovery document that omits the field.

Related errors

• Incompatible OIDC provider at ${endpointUrl}: does not suppo
• OAuth protected resource metadata URL ${resourceMetadataUrl.
• Incompatible auth server: does not support response type ${r
• Unsupported client authentication method: ${method}
• client_secret_basic authentication requires a client_secret

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/f927a9fb0d4be1d8. Report an issue: GitHub.