Tencent/WeKnora · error

failed to generate state: %w

Error message

failed to generate state: %w

What it means

Returned by StartAuthorization when transport.GenerateState fails to produce the OAuth CSRF state token (typically entropy/source failure in the OAuth library). Without a state token the authorization-code flow cannot start securely, so the flow aborts before building the auth URL.

Source

Thrown at internal/mcp/oauth_manager.go:129

		}
		if err := m.repo.SaveClient(ctx, &types.MCPOAuthClient{
			TenantID:    tenantID,
			ServiceID:   service.ID,
			ClientID:    clientID,
			RedirectURI: redirectURI,
		}); err != nil {
			logger.GetLogger(ctx).Warnf("failed to persist MCP oauth client: %v", err)
		}
	}

	verifier, err := transport.GenerateCodeVerifier()
	if err != nil {
		return "", "", fmt.Errorf("failed to generate PKCE verifier: %w", err)
	}
	challenge := transport.GenerateCodeChallenge(verifier)
	state, err := transport.GenerateState()
	if err != nil {
		return "", "", fmt.Errorf("failed to generate state: %w", err)
	}

	authURL, err := h.GetAuthorizationURL(ctx, state, challenge)
	if err != nil {
		return "", "", fmt.Errorf("failed to build authorization URL: %w", err)
	}

	if err := m.states.Put(ctx, state, OAuthState{
		TenantID:         tenantID,
		UserID:           principal.StorageID(),
		Principal:        principal,
		ServiceID:        service.ID,
		CodeVerifier:     verifier,
		ClientID:         h.GetClientID(),
		RedirectURI:      redirectURI,
		FrontendRedirect: frontendRedirect,
	}); err != nil {
		return "", "", fmt.Errorf("failed to persist authorization state: %w", err)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Check the system's cryptographic entropy source (crypto/rand availability)
2. Retry the authorization start; the failure is usually transient
3. Inspect the OAuth transport library version for known issues

When it happens

Trigger: Thrown at internal/mcp/oauth_manager.go:129 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/eb74047aa8c6c105. Report an issue: GitHub.