Incompatible OIDC provider at ${endpointUrl}: does not suppo

Error message

Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification

What it means

When discovering OpenID Connect provider metadata (.well-known/openid-configuration), the MCP client requires the provider to support the S256 PKCE code challenge method, as mandated by the MCP specification. If the discovered metadata's code_challenge_methods_supported array is missing or does not include 'S256', discovery throws this error instead of returning metadata that would lead to an unusable authorization flow.

Source

Thrown at packages/mcp/src/tool/oauth.ts:664

      }
      throw new Error(
        `HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`,
      );
    }

    if (type === 'oauth') {
      const metadata = OAuthMetadataSchema.parse(await response.json());
      assertMetadataIssuerMatches(metadata, expectedIssuer);
      return metadata;
    } else {
      const metadata = OpenIdProviderDiscoveryMetadataSchema.parse(
        await response.json(),
      );
      assertMetadataIssuerMatches(metadata, expectedIssuer);

      // MCP spec requires OIDC providers to support S256 PKCE
      if (!metadata.code_challenge_methods_supported?.includes('S256')) {
        throw new Error(
          `Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification`,
        );
      }

      return metadata;
    }
  }

  return undefined;
}

export async function startAuthorization(
  authorizationServerUrl: string | URL,
  {
    metadata,
    clientInformation,
    redirectUrl,
    scope,

View on GitHub (pinned to 69428b1f8b)

Solutions

Enable/verify S256 PKCE support on the OIDC provider (e.g. Keycloak: ensure the client's PKCE method is S256) and redeploy.
Check the provider's discovery document with curl to confirm code_challenge_methods_supported includes S256 after the change.
If the IdP genuinely cannot support S256, use an OAuth-style authorization server metadata endpoint (.well-known/oauth-authorization-server) instead, or front the IdP with a proxy that advertises and implements S256.
Clear any cached metadata (the discovery result is fetched fresh each auth run) and retry the MCP connection.

Example fix

// before: legacy IdP advertises only 'plain'
curl https://idp.example.com/.well-known/openid-configuration
// { "code_challenge_methods_supported": ["plain"] }

// after: enable S256 in the IdP client settings
curl https://idp.example.com/.well-known/openid-configuration
// { "code_challenge_methods_supported": ["S256", "plain"] }

Defensive patterns

Strategy: validation

Validate before calling

const metadata = await fetch('https://idp.example.com/.well-known/openid-configuration').then(r => r.json());
if (!metadata.code_challenge_methods_supported?.includes('S256')) {
  throw new Error('OIDC provider does not support S256 PKCE; fix IdP config before connecting MCP client');
}

Type guard

function supportsS256(m: { code_challenge_methods_supported?: string[] }): boolean {
  return Array.isArray(m.code_challenge_methods_supported) && m.code_challenge_methods_supported.includes('S256');
}

Try / catch

try {
  await connectToMcpServer(url);
} catch (error) {
  if (String(error.message).includes('does not support S256')) {
    alert('Authorization server is not MCP-compatible: enable S256 PKCE on your identity provider.');
  }
}

Prevention

Check code_challenge_methods_supported in the IdP discovery document during environment setup.
Pin/upgrade to an IdP version that supports S256 PKCE (RFC 7636).
Add a CI health check that asserts S256 support for each environment's IdP.

When it happens

Trigger: Calling discoverAuthorizationServerMetadata against a URL whose OpenID provider discovery endpoint returns metadata lacking S256 in code_challenge_methods_supported; also reached during auth() when the authorization server is an OIDC provider.

Common situations: Connecting an MCP client to a legacy OIDC provider (older Keycloak versions, some enterprise IdPs) configured with only the 'plain' PKCE method, or a metadata document that omits code_challenge_methods_supported entirely even though S256 is actually supported.

Related errors

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/a4378c6a5a86f280. Report an issue: GitHub.