{"record":{"id":"0740eeede3ccc70f","repo":"decolua/9router","slug":"invalid-token-format-token-should-start-with-aora","errorCode":null,"errorMessage":"Invalid token format. Token should start with aorAAAAAG...","messagePattern":"Invalid token format\\. Token should start with aorAAAAAG\\.\\.\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/kiro.js","lineNumber":244,"sourceCode":"      throw new Error(`Token refresh failed: ${error}`);\n    }\n\n    const data = await response.json();\n    return {\n      accessToken: data.accessToken,\n      refreshToken: data.refreshToken || refreshToken,\n      profileArn: data.profileArn,\n      expiresIn: data.expiresIn || 3600,\n    };\n  }\n\n  /**\n   * Validate and import refresh token\n   */\n  async validateImportToken(refreshToken) {\n    // Validate token format\n    if (!refreshToken.startsWith(\"aorAAAAAG\")) {\n      throw new Error(\"Invalid token format. Token should start with aorAAAAAG...\");\n    }\n\n    // Try to refresh to validate\n    try {\n      const result = await this.refreshToken(refreshToken);\n      return {\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken || refreshToken,\n        profileArn: result.profileArn,\n        expiresIn: result.expiresIn,\n        authMethod: \"imported\",\n      };\n    } catch (error) {\n      throw new Error(`Token validation failed: ${error.message}`);\n    }\n  }\n\n  /**","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/services/kiro.js#L226-L262","documentation":"Thrown by KiroService.validateImportToken when a manually pasted refresh token does not start with the required prefix \"aorAAAAAG\". Kiro/AWS refresh tokens have this literal prefix, so the check is a cheap pre-flight before spending a network round-trip on refreshToken(). It indicates the pasted string is not a Kiro refresh token (wrong token type, truncated, or from another provider).","triggerScenarios":"Calling validateImportToken with a token whose first characters are not \"aorAAAAAG\" — e.g. pasting an access token, an API key, an AWS secret key, or a token copied with leading whitespace trimmed away along with the prefix.","commonSituations":"Copy/paste truncation from a terminal; importing a token from a different tool (Cursor, CodeWhisperer API key); leading whitespace stripped along with the prefix by an editor; confusing the refresh token field with the access token field.","solutions":["Re-copy the full refresh token from the source and confirm it visibly starts with aorAAAAAG before importing.","Make sure you're copying the refresh token, not the access token or API key — only the refresh token carries this prefix.","Trim only whitespace, never the first characters; check the paste wasn't cut off at the start.","If the token genuinely lacks the prefix, it wasn't issued by Kiro's AWS flow and cannot be imported here."],"exampleFix":"// before: importing an access token by mistake\nawait svc.validateImportToken(accessToken);\n// after: verify prefix before calling\nconst rt = refreshToken.trim();\nif (!rt.startsWith(\"aorAAAAAG\")) throw new Error(\"Not a Kiro refresh token\");\nawait svc.validateImportToken(rt);","handlingStrategy":"validation","validationCode":"function isKiroRefreshToken(t) {\n  return typeof t === 'string' && t.trim().startsWith('aorAAAAAG') && t.trim().length > 30;\n}\nif (!isKiroRefreshToken(pasted)) {\n  throw new Error('Paste a Kiro refresh token (starts with aorAAAAAG), not an access token or API key');\n}","typeGuard":"function isKiroRefreshToken(v) { return typeof v === 'string' && v.trim().startsWith('aorAAAAAG'); }","tryCatchPattern":"try {\n  return await svc.validateImportToken(token);\n} catch (e) {\n  if (/Invalid token format/i.test(e.message)) {\n    showHelpText('The refresh token starts with aorAAAAAG — check you copied the full token');\n    return null;\n  }\n  throw e;\n}","preventionTips":["Pre-validate the aorAAAAAG prefix in the UI before calling the service, so users get instant feedback.","Label input fields explicitly 'refresh token' to avoid pasting access tokens or API keys.","Trim only whitespace; never strip leading characters from pasted tokens.","Check the paste is complete — terminal copies often truncate long tokens."],"tags":["oauth","token-import","validation","format"],"backgroundTag":"invalid-token-format","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}