diff --git a/CHANGES.rst b/CHANGES.rst
index e236fe4..cb40f1f 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -4,6 +4,12 @@ Changes
 Unreleased
 ====================================================================================================================
 
+Changes:
+
+* Fix ``twitcher.oauth2.CustomTokenValidator`` allowing non-string or empty ``issuer`` and ``secret`` configuration.
+  This ended up raising an error ``CustomTokenValidator.generate_access_token()`` call since the parameters must be
+  valid and defined strings for the ``jwt.encode`` function.
+
 0.11.1 (2026-01-09)
 ====================================================================================================================
 
diff --git a/tests/common.py b/tests/common.py
index 37c1cc0..c795cc9 100644
--- a/tests/common.py
+++ b/tests/common.py
@@ -26,6 +26,7 @@ class BaseTest(unittest.TestCase):
         'twitcher.password': 'testpassword',
         'twitcher.token.type': 'custom_token',
         'twitcher.token.secret': 'testsecret',
+        'twitcher.token.issuer': 'testissuer',
     }
 
     def setUp(self):
diff --git a/twitcher/oauth2.py b/twitcher/oauth2.py
index 8689ca4..bdebd06 100644
--- a/twitcher/oauth2.py
+++ b/twitcher/oauth2.py
@@ -168,6 +168,8 @@ def validate_bearer_token(self, token, scopes, request):
 
 class CustomTokenValidator(BaseValidator):
     def __init__(self, secret, issuer):
+        if not secret or not issuer or not isinstance(secret, str) or not isinstance(issuer, str):
+            raise ValueError('OAuth2 custom token secret and issuer must both be non-empty strings')
         self.secret = secret
         self.issuer = issuer