Hmbown/CodeWhale · error

OIDC discovery failed with HTTP

Error message

{name} OIDC discovery failed with HTTP {status}

What it means

The OAuth/OIDC discovery document was fetched from the provider, but the HTTP response status was not a success. The discovery request itself completed (parse succeeded context-wise), yet the server rejected the request with a non-2xx status, so no endpoints can be resolved.

Solutions

1. Verify the issuer URL is correct, including tenant/realm path and scheme.
2. Curl the provider's well-known discovery URL and inspect the returned status/body.
3. Check provider status/outage pages or proxy logs if the URL looks right.
4. Fall back to documented-path endpoints (no discovery) if the provider config supports them.

Example fix

// before
issuer = "https://auth.example.com/wrong-realm" // discovery failed with HTTP 404
// after
issuer = "https://auth.example.com/realms/correct" // discovery succeeds

let status = reqwest::get(format!("{issuer}/.well-known/openid-configuration")).await?.status();
if !status.is_success() { eprintln!("issuer discovery endpoint returned {status}"); }

match discover_oauth_endpoints(...).await {
    Ok(endpoints) => endpoints,
    Err(e) if e.to_string().contains("discovery failed with HTTP") => {
        tokio::time::sleep(Duration::from_secs(2)).await; // retry transient 5xx
        discover_oauth_endpoints(...).await?
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: discover_oauth_endpoints performing the OIDC well-known discovery GET and receiving a non-success HTTP status (e.g. 404 for a wrong issuer URL, 403, 5xx).

Common situations: Misconfigured issuer base URL in provider config; provider behind a proxy that returns errors; provider outage; wrong tenant/realm in the issuer path (e.g. wrong Keycloak realm).

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• OAuth callback must be GET
• OAuth device-code request failed
• OIDC discovery issuer does not match the requested issuer
• OIDC discovery returned unsupported
• returned HTTP with content type ; expected JSON

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/1e6c40d0b3bbce94. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/oauth.rs:638

fn discover_oauth_endpoints(params: &OAuthProviderParams, issuer: &str) -> Result<OAuthEndpoints> {
    let name = params.display_name;
    let discovery_url = oauth_endpoint_url(&format!(
        "{}/.well-known/openid-configuration",
        issuer.trim_end_matches('/')
    ))?;
    let client = oauth_http_client("OIDC discovery")?;
    #[cfg(test)]
    crate::external_credentials::record_oauth_network();
    let response = client
        .get(discovery_url)
        .header(reqwest::header::ACCEPT, "application/json")
        .send()
        .with_context(|| format!("{name} OIDC discovery request failed"))?;
    let (status, discovery): (_, OidcDiscoveryDocument) =
        parse_oauth_json(response, &format!("{name} OIDC discovery"))?;
    if !status.is_success() {
        bail!("{name} OIDC discovery failed with HTTP {status}");
    }
    validate_discovered_issuer(discovery.issuer, issuer)
        .with_context(|| format!("{name} OIDC discovery"))?;
    Ok(OAuthEndpoints {
        device_authorization_endpoint: params
            .device_code_path
            .map(|_| {
                validate_discovered_oauth_endpoint(
                    discovery.device_authorization_endpoint,
                    "device_authorization_endpoint",
                    issuer,
                )
            })
            .transpose()?,
        token_endpoint: validate_discovered_oauth_endpoint(
            discovery.token_endpoint,
            "token_endpoint",
            issuer,

View on GitHub (pinned to 73e0f67d83)