From fb8d71a47756f10fa795007fb67f7411bc82f027 Mon Sep 17 00:00:00 2001
From: Taesu <bytaesu@gmail.com>
Date: Tue, 21 Apr 2026 16:36:09 +0900
Subject: [PATCH] fix(oauth-provider): relax response_type enum for RFC 6749
 redirects

Co-authored-by: Ustay-coder <80252149+Ustay-coder@users.noreply.github.com>
---
 packages/oauth-provider/src/authorize.test.ts | 23 +++++++++++++++++++
 packages/oauth-provider/src/oauth.ts          |  2 +-
 packages/oauth-provider/src/types/index.ts    |  2 +-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/packages/oauth-provider/src/authorize.test.ts b/packages/oauth-provider/src/authorize.test.ts
index 27d2d3a87e..a2e947d81d 100644
--- a/packages/oauth-provider/src/authorize.test.ts
+++ b/packages/oauth-provider/src/authorize.test.ts
@@ -418,6 +418,29 @@ describe("oauth authorize - authenticated", async () => {
 		);
 	});
 
+	/**
+	 * @see https://github.com/better-auth/better-auth/issues/9250
+	 */
+	it("should redirect with unsupported_response_type for an unknown response_type", async () => {
+		if (!oauthClient?.client_id) {
+			throw Error("beforeAll not run properly");
+		}
+		const authUrl = new URL(`${authServerBaseUrl}/api/auth/oauth2/authorize`);
+		authUrl.searchParams.set("client_id", oauthClient.client_id);
+		authUrl.searchParams.set("redirect_uri", redirectUri);
+		authUrl.searchParams.set("response_type", "token");
+		authUrl.searchParams.set("scope", "openid");
+
+		let errorRedirectUrl = "";
+		await client.$fetch(authUrl.toString(), {
+			onError(context) {
+				errorRedirectUrl = context.response.headers.get("Location") || "";
+			},
+		});
+
+		expect(errorRedirectUrl).toContain("error=unsupported_response_type");
+	});
+
 	/**
 	 * @see https://github.com/better-auth/better-auth/issues/9250
 	 */
diff --git a/packages/oauth-provider/src/oauth.ts b/packages/oauth-provider/src/oauth.ts
index 942b6d641c..1ce63eaefa 100644
--- a/packages/oauth-provider/src/oauth.ts
+++ b/packages/oauth-provider/src/oauth.ts
@@ -372,7 +372,7 @@ export const oauthProvider = <O extends OAuthOptions<Scope[]>>(options: O) => {
 				{
 					method: "GET",
 					query: z.object({
-						response_type: z.enum(["code"]).optional(),
+						response_type: z.string().optional(),
 						client_id: z.string(),
 						redirect_uri: SafeUrlSchema.optional(),
 						scope: z.string().optional(),
diff --git a/packages/oauth-provider/src/types/index.ts b/packages/oauth-provider/src/types/index.ts
index c62c1d08e9..4e0d6a3889 100644
--- a/packages/oauth-provider/src/types/index.ts
+++ b/packages/oauth-provider/src/types/index.ts
@@ -729,7 +729,7 @@ export interface OAuthAuthorizationQuery {
 	 * Optional in the query when using request_uri (PAR) — resolved from stored params.
 	 */
 	// NEVER SUPPORT "token" or "id_token" - depreciated in oAuth2.1
-	response_type?: "code";
+	response_type?: string;
 	/**
 	 * PAR request_uri. When present, other params are resolved from the stored request.
 	 */