QuantumNous/new-api · error · Error

Failed to initialize OAuth

Error message

Failed to initialize OAuth

What it means

Thrown by getOauthState() after POST /api/oauth/state returns a body with success falsy (or a shape without a usable state/flow_token string). The backend OAuth state endpoint refused to initialize the flow, so the frontend cannot build the provider redirect URL. This is a server-side rejection surfaced to the caller, not a network exception (network failures would reject before reaching the throw).

Source

Thrown at web/src/features/auth/api.ts:157

// Get OAuth state for CSRF protection
export async function createOAuthFlow(
  provider: string,
  intent: 'login' | 'bind'
): Promise<string> {
  const aff = intent === 'login' ? getAffiliateCode() : ''
  const res = await api.post(
    '/api/oauth/state',
    { provider, intent, aff: aff || undefined },
    { skipAuthRefresh: intent === 'login' }
  )
  if (res.data?.success) {
    if (typeof res.data.data === 'string') return res.data.data
    if (typeof res.data.data?.flow_token === 'string') {
      return res.data.data.flow_token
    }
  }
  throw new Error(res.data?.message || 'Failed to initialize OAuth')
}

// WeChat login by authorization code
export async function wechatLoginByCode(code: string): Promise<ApiResponse> {
  const res = await api.get('/api/oauth/wechat', { params: { code } })
  return res.data
}

export async function telegramLogin(
  authorization: TelegramAuthorization
): Promise<ApiResponse> {
  const res = await api.get('/api/oauth/telegram/login', {
    params: authorization,
    disableDuplicate: true,
    skipAuthRefresh: true,
    skipBusinessError: true,
    skipErrorHandler: true,
  })

View on GitHub (pinned to e2c7aa7b10)

Solutions

1. Inspect the network response of POST /api/oauth/state — the server's message field usually names the exact cause (e.g. 'provider is not configured').
2. Verify the OAuth provider is enabled and has valid client_id/client_secret in the admin OAuth settings.
3. Confirm the provider string passed from the frontend matches a provider key the backend supports.
4. If the backend returns an unexpected data shape, update this function to read the new field (it currently accepts only string or data.flow_token).

Example fix

// before
if (res.data?.success) {
  if (typeof res.data.data === 'string') return res.data.data
  if (typeof res.data.data?.flow_token === 'string') {
    return res.data.data.flow_token
  }
}
throw new Error(res.data?.message || 'Failed to initialize OAuth')

// after — surface the server message and unexpected shapes distinctly
if (res.data?.success) {
  if (typeof res.data.data === 'string') return res.data.data
  if (typeof res.data.data?.flow_token === 'string') {
    return res.data.data.flow_token
  }
  throw new Error('Unexpected OAuth state response shape')
}
throw new Error(res.data?.message || 'Failed to initialize OAuth')

const OAUTH_PROVIDERS = new Set(['github', 'discord', 'oidc', 'linuxdo', 'wechat', 'telegram'])
if (!OAUTH_PROVIDERS.has(provider)) {
  throw new Error(`Unknown OAuth provider: ${provider}`)
}

const isOauthProvider = (p: unknown): p is string =>
  typeof p === 'string' && p.length > 0

try {
  const state = await getOauthState(provider, intent)
  window.location.assign(buildAuthorizeUrl(provider, state))
} catch (e) {
  toast.error(getErrorMessage(e) || 'Failed to initialize OAuth')
  setBusy(false)
}

When it happens

Trigger: Calling the OAuth login/bind flow with a provider that is disabled or misconfigured server-side (missing client_id/secret in admin settings); POST /api/oauth/state returning {success:false, message:'...'}; backend returning success:true but data being neither a string nor an object with flow_token.

Common situations: Admin has not configured the GitHub/OIDC/Discord client credentials; the provider name sent does not match a registered provider; session/aff parameters rejected; backend upgraded and changed the state response shape so res.data.data is an unexpected type.

Related errors

• Failed to sign out session
• Failed to start verification
• Unsupported verification method: {{method}}
• Passkey verification was cancelled
• Passkey verification failed

AI-assisted analysis of QuantumNous/new-api@e2c7aa7b10 (2026-08-15). Data as JSON: /api/errors/c89d1330786c6bc7. Report an issue: GitHub.