AlistGo/alist · error

need verify: <a target="_blank" href="%s">Click Here</a>

Error message

need verify: <a target="_blank" href="%s">Click Here</a>

What it means

Returned by HalalCloud's auth flow when the OAuth/login endpoint responds with a non-empty Url field alongside the token exchange. The service is demanding interactive identity verification (device check / captcha / risk control) before it will finish authorizing the session, and the only way forward is for a human to open that URL in a browser.

Source

Thrown at drivers/halalcloud/util.go:83

	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	stateString := uuid.New().String()
	// queryValues.Add("callback", oauthToken.Callback)
	oauthToken, err := userClient.CreateAuthToken(ctx, &pbPublicUser.LoginRequest{
		ReturnType: 2,
		State:      stateString,
		ReturnUrl:  "",
	})
	if err != nil {
		return nil, err
	}
	if len(oauthToken.State) < 1 {
		oauthToken.State = stateString
	}

	if oauthToken.Url != "" {

		return nil, fmt.Errorf(`need verify: <a target="_blank" href="%s">Click Here</a>`, oauthToken.Url)
	}

	return aService, err2

}

func (d *HalalCloud) NewAuthService(refreshToken string, options ...HalalOption) (*AuthService, error) {
	svc := d.HalalCommon.AuthService

	if len(refreshToken) < 1 {
		refreshToken = d.Addition.RefreshToken
	}

	if len(d.tr.AccessToken) > 0 {
		accessTokenExpiredAt := d.tr.AccessTokenExpiredAt
		current := time.Now().UnixMilli()
		if accessTokenExpiredAt < current {
			// access token expired

View on GitHub (pinned to 843d9dc814)

Solutions

1. Click the embedded link (or give it to the account owner) and complete the verification in a browser where the account is already logged in.
2. Re-login in the browser first, then re-run the driver's login/token flow so risk-control state is cleared.
3. Whitelist/stabilize the egress IP for the server running the driver to avoid repeated risk challenges.
4. After verifying, generate a fresh refresh token via the official flow and update the driver config instead of reusing the challenged one.

svc, err := d.NewAuthService(token)
if err != nil && strings.Contains(err.Error(), "need verify") {
    url := extractHref(err.Error())
    surfaceToUser("complete verification at " + url) // human-in-the-loop
    return err
}

When it happens

Trigger: Logging in from a new IP, new device fingerprint, or datacenter IP that trips HalalCloud risk control; refreshing a refresh token that was issued in a different session context; repeated login attempts in a short window.

Common situations: Self-hosted OpenList/AList instances on VPS IPs flagged by the provider; users rotating refresh tokens in config without completing verification; time-skewed clients causing the server to treat the login as suspicious.

Related errors

• failed to refresh token: refresh token is empty
• not a jwt token because of invalid segments
• addr is nil
• lark refresh token expired
• lark refresh token response missing access token

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/93f1c15cf2bfef7d. Report an issue: GitHub.