Tencent/WeKnora · error

token exchange failed: %w

Error message

token exchange failed: %w

What it means

Returned by CompleteAuthorization when h.ProcessAuthorizationResponse fails to exchange the authorization code for tokens (invalid or expired code, PKCE mismatch, provider rejection, or network failure to the token endpoint). The user's authorization does not complete and must be restarted.

Source

Thrown at internal/mcp/oauth_manager.go:216

	service, err := m.serviceRepo.GetByID(ctx, st.TenantID, st.ServiceID)
	if err != nil {
		return frontendRedirect, serviceID, fmt.Errorf("failed to load MCP service: %w", err)
	}
	if service == nil {
		return frontendRedirect, serviceID, fmt.Errorf("MCP service not found")
	}

	h, err := m.newHandler(ctx, service, st.TenantID, principal, st.RedirectURI)
	if err != nil {
		return frontendRedirect, serviceID, err
	}
	// Re-prime the expected state so the library's CSRF check passes after
	// reconstructing the handler in this separate request.
	h.SetExpectedState(state)

	if err := h.ProcessAuthorizationResponse(ctx, code, state, st.CodeVerifier); err != nil {
		return frontendRedirect, serviceID, fmt.Errorf("token exchange failed: %w", err)
	}
	if err := m.states.CompleteAttempt(ctx, state); err != nil {
		return frontendRedirect, serviceID, fmt.Errorf("failed to record authorization completion: %w", err)
	}
	// ProcessAuthorizationResponse persists the token via the TokenStore.
	logger.GetLogger(ctx).Infof(
		"MCP OAuth authorized: service=%s principal=%s", st.ServiceID, principal.StorageID(),
	)
	return frontendRedirect, serviceID, nil
}

// IsAuthorizationAttemptComplete reports whether this exact authorization
// attempt completed for the requested principal and service. A pre-existing
// token must never satisfy a newly opened OAuth popup.
func (m *OAuthManager) IsAuthorizationAttemptComplete(
	ctx context.Context,
	tenantID uint64,
	principal types.Principal,

View on GitHub (pinned to 988cbb0330)

Solutions

1. Inspect the wrapped error from the token endpoint
2. Auth codes are single-use and short-lived — restart the flow with a fresh code
3. Verify client ID/secret, redirect URI, and PKCE verifier consistency
4. Check connectivity to the OAuth provider's token endpoint

When it happens

Trigger: Thrown at internal/mcp/oauth_manager.go:216 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/b83971e5ec39be75. Report an issue: GitHub.