Custom provider error: invalid_client

[abdullahahmeda]

I have a custom provider as follows:

{
    id: "salla",
    name: "Salla",
    type: "oauth",
    authorization: {
      url: "https://accounts.salla.sa/oauth2/auth",
      params: {
        scope: "",        
      },
    },
    token: "https://accounts.salla.sa/oauth2/token",
    userinfo: "https://accounts.salla.sa/oauth2/user/info",
    idToken: false,
    profile(profile) {
      console.log(profile);
      return {
        id: profile.id.toString(),
        name: profile.name,
        email: profile.email,
      };
    },
    clientId: 'MY_CLIENT_ID',
    clientSecret: 'MY_CLIENT_SECRET'
  }

The login page works properly. When I login to the provider with the correct credentials, I get redirected to redirect_uri (which is /api/auth/callback/salla), I get the following error:

[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_post', but method 'client_secret_basic' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_basic'.) {
  error: OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_post', but method 'client_secret_basic' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_basic'.)

I changed redirect_uri to a custom value to see if the provider redirects to the correct page with the correct params. The provider I am using seems to redirect to redirect_uri with the proper params/query string. Here is a sample:
http://localhost:3000/test-redirect?code=ory_ac_hf6lgSFC8NvqvNABx7NZZXD9ES-MvwYeuBxqyNeClDw.h3IIYYoumCSdfCatLpnSsjPaDMF6R1_VRpc6tVosbYw&scope=settings.read+offline_access&state=AXy0dSYxg7fZahhbP4qoZOJR6PVbMofJeMgZM5KufxI

So eventually, code, state and scope are in the params/query string. So what could be the error?

I have an initial guess that the error occurs because code is not a valid JWT (I don't know if next-auth tries to decode code or no, but I have seen other people do this). How can I stop decoding code? and how to solve the issue?

Thanks

[abdullahahmeda]

I have just fixed it by adding:

client: {
  token_endpoint_auth_method: 'client_secret_post'
}

More info can be found here.