aaif-goose/goose · error

OAuth authentication failed for {}: {}

Error message

OAuth authentication failed for {}: {}

What it means

During `goose configure`, provider OAuth is exercised by creating the provider and calling `configure_oauth()`. When the OAuth flow itself fails, the error is wrapped with this message; the placeholders carry the secret key name and the underlying provider error, and cliclack has already printed 'Failed to authenticate: ...' with the same cause.

Source

Thrown at crates/goose-cli/src/commands/configure.rs:459

}

/// Helper function to handle OAuth configuration for a provider
async fn handle_oauth_configuration(provider_name: &str, key_name: &str) -> anyhow::Result<()> {
    let _ = cliclack::log::info(format!(
        "Configuring {} using OAuth device code flow...",
        key_name
    ));

    // Create a temporary provider instance to handle OAuth
    match create(provider_name, Vec::new()).await {
        Ok(provider) => match provider.configure_oauth().await {
            Ok(_) => {
                let _ = cliclack::log::success("OAuth authentication completed successfully!");
                Ok(())
            }
            Err(e) => {
                let _ = cliclack::log::error(format!("Failed to authenticate: {}", e));
                Err(anyhow::anyhow!(
                    "OAuth authentication failed for {}: {}",
                    key_name,
                    e
                ))
            }
        },
        Err(e) => {
            let _ = cliclack::log::error(format!("Failed to create provider for OAuth: {}", e));
            Err(anyhow::anyhow!(
                "Failed to create provider for OAuth: {}",
                e
            ))
        }
    }
}

const UNLISTED_MODEL_KEY: &str = "__unlisted__";

View on GitHub (pinned to 3810898a74)

Solutions

1. Read the appended underlying error text — it states the actual failure (callback, exchange, cancellation)
2. Ensure a browser can open and reach the localhost redirect
3. Retry the flow once; transient callback races do occur
4. Fall back to manual API-key authentication for that provider if it supports one

// Rust: retry transient OAuth failures, keep the provider error chain
for attempt in 0..2 {
    match provider.configure_oauth().await {
        Ok(_) => break,
        Err(e) if attempt == 1 => return Err(anyhow::anyhow!("OAuth authentication failed: {e}")),
        Err(_) => tokio::time::sleep(std::time::Duration::from_secs(2)).await,
    }
}

When it happens

Trigger: Selecting OAuth sign-in for a provider in `goose configure` when the browser-based flow fails: the localhost callback is unreachable, the provider rejects the client request, the user cancels, or the token exchange errors.

Common situations: SSH/headless machines where no browser can open the callback; corporate proxies blocking localhost callbacks; expired or misconfigured OAuth client registration; provider outages.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to create provider for OAuth: {}
• provider check failed
• TLS was requested but no TLS backend is enabled. Enable the
• {label} subprocess exited with status {}: {}
• Failed to create model configuration: {e}

AI-assisted analysis of aaif-goose/goose@3810898a74 (2026-08-16). Data as JSON: /api/errors/021e8aa9c8087270. Report an issue: GitHub.