Foundry376/Mailspring · error

O365 profile request returned ${meResp.status} ${meResp.stat

Error message

O365 profile request returned ${meResp.status} ${meResp.statusText}: ${JSON.stringify(me)}

What it means

Guard in buildMicrosoftAccountFromAuthResponse: the Microsoft Graph /v1.0/me call made with the freshly obtained access token returned a non-ok status. The token exchange succeeded but the user profile could not be read, so O365/Outlook account construction fails; typically a missing User.Read scope or an invalid token audience.

Source

Thrown at app/internal_packages/onboarding/lib/onboarding-helpers.ts:294

  const { access_token, refresh_token, id_token } = await fetchPostWithFormBody<TokenResponse>(
    `https://login.microsoftonline.com/common/oauth2/v2.0/token`,
    {
      code: code,
      scope: O365_SCOPES.filter((f) => !f.startsWith('https://outlook.office.com')).join(' '),
      client_id: O365_CLIENT_ID,
      code_verifier: CODE_VERIFIER,
      grant_type: `authorization_code`,
      redirect_uri: `http://localhost:${LOCAL_SERVER_PORT}/desktop`,
    }
  );

  // get the user's email address
  const meResp = await fetch('https://graph.microsoft.com/v1.0/me', {
    headers: { Authorization: `Bearer ${access_token}` },
  });
  const me = await meResp.json();
  if (!meResp.ok) {
    throw new Error(
      `O365 profile request returned ${meResp.status} ${meResp.statusText}: ${JSON.stringify(me)}`
    );
  }
  // The Graph API can return 200 OK with an error body in some edge cases
  if (me.error) {
    throw new Error(`O365 profile request failed: ${me.error.code}: ${me.error.message}`);
  }

  // Try multiple sources to find the email address. For most work accounts `mail` or
  // `userPrincipalName` is set. For personal MSA accounts or accounts without Exchange
  // Online licenses, fall back to the id_token claims (requires openid+email scopes).
  let emailAddress: string | null = me.mail || me.userPrincipalName || null;

  if (!emailAddress && id_token) {
    try {
      // Decode id_token JWT payload (base64url encoded) to extract email claims
      const payload = JSON.parse(Buffer.from(id_token.split('.')[1], 'base64').toString('utf8'));
      const candidate: string = payload.email || payload.preferred_username || payload.unique_name;

View on GitHub (pinned to 648c685d60)

Solutions

1. Confirm the O365_SCOPES used during authorization include Graph's User.Read
2. Retry onboarding to obtain a fresh token
3. Check the embedded JSON body for the Graph error code (e.g. InvalidAuthenticationToken)

When it happens

Trigger: Thrown at app/internal_packages/onboarding/lib/onboarding-helpers.ts:294 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Foundry376/Mailspring@648c685d60 (2026-09-03). Data as JSON: /api/errors/c322c04dce306fcb. Report an issue: GitHub.