Kong/insomnia · error

OAuth 2.0 Error

Error message

OAuth 2.0 Error ${code}

${msg}

${uri}

What it means

Formatted OAuth 2.0 provider error raised in getOAuth2Token: the authorization redirect back from the provider carried an error query parameter (with optional error_description and error_uri), so the code-for-token exchange is aborted.

Solutions

1. Read error_description/error_uri for the provider-specific cause (bad client_id, denied consent, mismatched redirect URI)
2. Fix the OAuth app configuration on the provider and retry the flow
3. If consent was denied, re-authorize and approve the requested scopes

When it happens

Trigger: Thrown at packages/insomnia/src/main/network/o-auth-2/get-token.ts:333 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/753d72c6d4b53d40. Report an issue: GitHub.

Appendix: source

Thrown at packages/insomnia/src/main/network/o-auth-2/get-token.ts:333

          });
        } catch (err) {
          timeline.push(logEntry(`Authorization window error: ${err.message}`));
          throw err;
        }
      }

      console.log('[oauth2] Detected redirect ' + redirectedTo);
      timeline.push(
        logEntry(`Authorization redirect detected: ${redirectedTo}`),
        logEntry('Exchanging code for token'),
      );
      const redirectParams = Object.fromEntries(new URL(redirectedTo).searchParams);
      if (redirectParams.error) {
        const code = redirectParams.error;
        const msg = redirectParams.error_description;
        const uri = redirectParams.error_uri;
        timeline.push(logEntry(`Authorization error: ${code} - ${msg || 'no description'}`));
        throw new Error(`OAuth 2.0 Error ${code}\n\n${msg}\n\n${uri}`);
      }
      console.log('[oauth2] Detected code ' + redirectParams.code);
      params = [
        { name: 'grant_type', value: GRANT_TYPE_AUTHORIZATION_CODE },
        { name: 'code', value: redirectParams.code },
        ...insertAuthKeyIf('redirect_uri', redirectUrl),
        ...insertAuthKeyIf('audience', authentication.audience),
        ...insertAuthKeyIf('resource', authentication.resource),
        ...insertAuthKeyIf('code_verifier', codeVerifier),
      ];
    } else if (authentication.grantType === 'password') {
      params = [
        { name: 'grant_type', value: 'password' },
        ...insertAuthKeyIf('username', authentication.username),
        ...insertAuthKeyIf('password', authentication.password),
        ...insertAuthKeyIf('scope', authentication.scope),
        ...insertAuthKeyIf('audience', authentication.audience),
      ];

View on GitHub (pinned to d9bb2b0142)