Unexpected response when fetching openid-configuration: ${re

Error message

Unexpected response when fetching openid-configuration: ${response.statusText}

What it means

After fetching the OIDC discovery document (openid-configuration) from configUrl, fetchStrategyConfig checks response.ok. Any non-2xx HTTP status causes this error with the statusText embedded. It indicates the IdP's discovery endpoint refused the request rather than returning metadata.

Source

Thrown at packages/backend-core/src/middleware/passport/sso/oidc.ts:236

    const {
      clientID,
      clientSecret,
      configUrl,
      pkce,
      allowUnverifiedEmailLinking,
    } = oidcConfig

    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {
      // check for remote config and all required elements
      throw new Error(
        "Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl"
      )
    }

    const response = await fetch(configUrl)

    if (!response.ok) {
      throw new Error(
        `Unexpected response when fetching openid-configuration: ${response.statusText}`
      )
    }

    const body = await response.json()

    return {
      issuer: body.issuer,
      authorizationURL: body.authorization_endpoint,
      tokenURL: body.token_endpoint,
      userInfoURL: body.userinfo_endpoint,
      clientID: clientID,
      clientSecret: clientSecret,
      callbackURL: callbackUrl,
      pkce: pkce,
      allowUnverifiedEmailLinking: resolveAllowUnverifiedEmailLinking(
        allowUnverifiedEmailLinking
      ),

View on GitHub (pinned to a81a902e9a)

Solutions

Verify configUrl returns 200 when curled from the Budibase server host (network/DNS/firewall can differ from your laptop)
Check the statusText in the message: 404 → fix the discovery URL/realm name; 401/403 → remove auth requirements or allowlist the server IP
Confirm the IdP service is up and serving /.well-known/openid-configuration
Retry after transient IdP downtime, especially if this surfaced during refreshOIDCAccessToken

Example fix

// before
configUrl: "https://keycloak.example.com/realms/wrong/.well-known/openid-configuration" // 404
// after
configUrl: "https://keycloak.example.com/realms/master/.well-known/openid-configuration"

Defensive patterns

Strategy: retry

Validate before calling

async function discoveryReachable(configUrl) {
  try {
    const res = await fetch(configUrl)
    return res.ok
  } catch {
    return false
  }
}

Try / catch

try {
  await enrichedConfig(provider)
} catch (err) {
  if (String(err.message).startsWith("Unexpected response when fetching openid-configuration")) {
    // exponential backoff retry for transient 5xx; alert on persistent 401/403/404
  }
}

Prevention

curl the configUrl from the server host during setup to confirm 200 + JSON
Use the exact issuer-based discovery URL including the correct realm/tenant path
Allowlist the server's egress IP at the IdP/proxy if it restricts access
Monitor IdP health; alert when discovery fetches fail repeatedly

When it happens

Trigger: fetch(configUrl) returns 401/403/404/500 — e.g. wrong discovery URL, IdP requiring auth or IP allowlisting, or the IdP being down.

Common situations: configUrl typo (404); self-hosted Keycloak realm name wrong in the URL; corporate firewall blocking the server's outbound request; IdP temporarily unavailable during login or token refresh.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/88a834a59216f540. Report an issue: GitHub.