Problem

VS Code's MCP OAuth implementation was hardcoding token_endpoint_auth_method: 'none' during dynamic client registration, regardless of what authentication methods the authorization server actually supported. This caused token endpoint requests to fail for servers that required client authentication.

Specifically:

• The fetchDynamicRegistration function always requested 'none' authentication
• When servers returned a client_secret in the registration response, it wasn't being used properly for token requests
• Servers supporting only client_secret_basic (like the MCP server in the issue) would reject token requests due to missing authentication

Solution

1. Smart Authentication Method Selection

Updated fetchDynamicRegistration() to inspect the server's token_endpoint_auth_methods_supported and choose the most appropriate method:

• Prefer client_secret_basic if supported
• Fall back to client_secret_post if supported
• Default to none if neither is supported

2. Proper Client Authentication in Token Requests

Updated exchangeCodeForToken() and exchangeRefreshTokenForToken() to handle different authentication methods correctly:

client_secret_basic: Use HTTP Basic authentication

Authorization: Basic <base64(client_id:client_secret)>

client_secret_post: Include credentials in request body (existing behavior)

client_id=...&client_secret=...

none: Include only client_id in request body (existing behavior)

client_id=...

3. State Management

Added _tokenEndpointAuthMethod field to DynamicAuthProvider to track the negotiated authentication method from registration through to token requests.

Example

Before this fix, a server with this metadata would fail:

{
  "token_endpoint_auth_methods_supported": ["client_secret_basic"],
  "registration_endpoint": "http://localhost:3000/oauth/register"
}

VS Code would request token_endpoint_auth_method: 'none' during registration, receive a client_secret, but then send token requests without proper authentication, causing them to be rejected.

After this fix, VS Code will:

1. Request token_endpoint_auth_method: 'client_secret_basic' during registration
2. Store the returned client_secret and auth method
3. Send token requests with proper HTTP Basic authentication

Compatibility

• Fully backward compatible with existing OAuth servers
• Gracefully handles servers that don't specify supported auth methods
• Falls back to previous behavior when dynamic registration fails

Fixes #257277.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.