QuantumNous/new-api · error · Error

Missing code

Error message

Missing code

What it means

Thrown in the OAuth account-binding popup message handler when a postMessage from the provider popup contains neither code nor error. The handler has already matched provider, state, and window.source against the stored pending binding, so this is a well-formed OAuth redirect callback that simply lacks both payload fields.

Source

Thrown at web/src/features/profile/components/tabs/account-bindings-tab.tsx:241

      const message = event.data as Partial<OAuthBindingCallback> | null
      const pending = pendingOAuthBinding.current
      if (
        !message ||
        message.type !== OAUTH_BIND_CALLBACK_MESSAGE ||
        !pending ||
        message.provider !== pending.provider ||
        message.state !== pending.state ||
        event.source !== pending.popup
      ) {
        return
      }

      clearPendingOAuthBinding(pending)
      let success = false
      let resultMessage = t('OAuth failed')
      try {
        if (!message.code && !message.error) {
          throw new Error(t('Missing code'))
        }
        const params: Record<string, string> = { state: message.state }
        if (message.code) params.code = message.code
        if (message.error) params.error = message.error
        if (message.errorDescription) {
          params.error_description = message.errorDescription
        }
        const response = await api.get(`/api/oauth/${message.provider}`, {
          params,
          skipBusinessError: true,
        })
        success = Boolean(response.data?.success)
        resultMessage = response.data?.message || resultMessage
        if (success) {
          toast.success(t('Binding successful!'))
          onUpdate()
          await fetchCustomBindings()
        } else {

View on GitHub (pinned to e2c7aa7b10)

Solutions

1. In the popup's final URL, verify the query string contains code or error; if not, fix the OAuth app's callback/redirect URI configuration.
2. Confirm the backend OAuth URL builder appends the correct redirect_uri and that state round-trips with the code attached.
3. Check provider docs for changed response modes (query vs form_post); form_post payloads will not arrive via query params.
4. Test with the provider's default flow in a clean browser profile to rule out extensions stripping params.

// before acting on any postMessage, require a usable payload
function isUsableOAuthMessage(message: unknown): boolean {
  if (typeof message !== 'object' || message === null) return false
  const m = message as Record<string, unknown>
  return typeof m.code === 'string' && m.code.length > 0 ||
         typeof m.error === 'string' && m.error.length > 0
}
// in the handler:
if (!isUsableOAuthMessage(message)) { /* ignore or show provider error */ return }

function isOAuthCallbackMessage(m: unknown): m is { code?: string; error?: string; errorDescription?: string; state: string; provider: string } {
  if (typeof m !== 'object' || m === null) return false
  const o = m as Record<string, unknown>
  return typeof o.state === 'string' && typeof o.provider === 'string' &&
    (typeof o.code === 'undefined' || typeof o.code === 'string') &&
    (typeof o.error === 'undefined' || typeof o.error === 'string')
}

When it happens

Trigger: Provider redirects back with only state (e.g. user closed an intermediate consent step, provider SPA bug), popup posts an initial handshake message without code/error that happens to match state, provider returns an empty success redirect, or a misconfigured callback URL drops the query string.

Common situations: OAuth app callback URL misconfigured so authorization code is lost; provider-side changes to the redirect format; popup blockers or browser privacy extensions stripping query params; third-party provider (Discord/GitHub/OIDC) returning an unusual response.

Related errors

• Failed to initialize OAuth
• Failed to refresh credential

AI-assisted analysis of QuantumNous/new-api@e2c7aa7b10 (2026-08-15). Data as JSON: /api/errors/d38e6b9b5681410c. Report an issue: GitHub.