Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

unsupported_response_type

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The authorization request asked for a response type this server does not serve (RFC 6749 §4.1.2.1).

Meaning

This server serves the authorization code flow, and the OpenID Connect implicit flow (id_token and id_token token) only where issuer.implicit_flow is on and the organization is not in FAPI mode. A response_type outside those three in the query fails schema validation and gets a problem document instead; this error is sent when the request has no response_type at all, when it asks for an implicit type the organization does not serve, or when the value that counts is inside a signed request object or a pushed request and is not served. At /authorize it is redirected to the client's validated redirect URI; at /par it is the response body.

Impact

The flow never starts. It is a client bug, a library configured for the hybrid flow, or an implicit client against an organization that does not serve the implicit flow; the user is returned to the application with the error before any sign-in.

Diagnosis

  1. Check the response_type the client sends, including inside its request object.
  2. Read response_types_supported in the organization's discovery document: the implicit types appear only where the organization serves them.
  3. The audit record under oauth.authorization.requested has reason unsupported_response_type and cause response_type_unsupported. Find it by X-Request-ID, or filter the Audit log by client and reason.

Mitigation

  • As a client developer: send response_type=code with PKCE. Disable implicit and hybrid options in your OpenID Connect library.
  • As an operator: if a relying party cannot move off the implicit flow, set issuer.implicit_flow: true. An organization in FAPI mode never serves it.
  • As a user: tell the application's owner.

Escalation

If response_type=code, or an implicit type the discovery document lists, is refused, open an issue with the request id and the server version. Never attach the request object.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.