{"record":{"id":"49c11e5caac49c9f","repo":"decolua/9router","slug":"failed-to-register-client-error","errorCode":null,"errorMessage":"Failed to register client: ${error}","messagePattern":"Failed to register client: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/kiro.js","lineNumber":39,"sourceCode":"    const endpoint = `https://oidc.${region}.amazonaws.com/client/register`;\n\n    const response = await fetch(endpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({\n        clientName: KIRO_CONFIG.clientName,\n        clientType: KIRO_CONFIG.clientType,\n        scopes: KIRO_CONFIG.scopes,\n        grantTypes: KIRO_CONFIG.grantTypes,\n        issuerUrl: KIRO_CONFIG.issuerUrl,\n      }),\n    });\n\n    if (!response.ok) {\n      const error = await response.text();\n      throw new Error(`Failed to register client: ${error}`);\n    }\n\n    const data = await response.json();\n    return {\n      clientId: data.clientId,\n      clientSecret: data.clientSecret,\n      clientSecretExpiresAt: data.clientSecretExpiresAt,\n    };\n  }\n\n  /**\n   * Start device authorization for AWS Builder ID or IDC\n   */\n  async startDeviceAuthorization(clientId, clientSecret, startUrl, region = \"us-east-1\") {\n    assertValidAwsRegion(region);\n    const endpoint = `https://oidc.${region}.amazonaws.com/device_authorization`;\n\n    const response = await fetch(endpoint, {","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/services/kiro.js#L21-L57","documentation":"Thrown by KiroService.registerClient when the AWS SSO OIDC endpoint (https://oidc.<region>.amazonaws.com/client/register) responds with a non-2xx status. The raw response body is interpolated into the message, so it typically contains AWS's JSON error such as invalidRequest or accessDenied. Without a registered client there is no clientId/clientSecret, so the device-code flow cannot start.","triggerScenarios":"POST to oidc.<region>.amazonaws.com/client/register returns !response.ok — e.g. an unsupported/typo'd region passed to registerClient, AWS rejecting the clientName/scopes/grantTypes payload, or network/AWS outage returning 4xx/5xx.","commonSituations":"Passing a region not valid for AWS SSO OIDC; AWS throttling (429) the register endpoint; a corporate proxy returning an HTML error page; KIRO_CONFIG constants drifted from what AWS currently accepts.","solutions":["Read the interpolated response body in the message — AWS returns a JSON error code naming the exact problem.","Verify the region argument is a valid AWS SSO OIDC region (the code validates it via assertValidAwsRegion before the call).","Retry after a short backoff if the body indicates throttling (429 / SlowDown).","Confirm outbound HTTPS to oidc.<region>.amazonaws.com is not blocked by proxy/firewall."],"exampleFix":"// before: unknown region string\nconst svc = new KiroService();\nawait svc.registerClient(\"eu-central-2\");\n// after: use a supported SSO OIDC region\nawait svc.registerClient(\"us-east-1\");","handlingStrategy":"retry","validationCode":"const VALID_REGIONS = [\"us-east-1\",\"us-west-2\",\"eu-west-1\",\"eu-central-1\",\"ap-southeast-1\",\"ap-southeast-2\"];\nif (!VALID_REGIONS.includes(region)) throw new Error(`Unsupported SSO OIDC region: ${region}`);","typeGuard":"function isNonEmpty(s) { return typeof s === 'string' && s.trim().length > 0; }\nfunction validRegionArgs(r) { return isNonEmpty(r); }","tryCatchPattern":"try {\n  return await svc.registerClient(region);\n} catch (e) {\n  if (/throttl|429|SlowDown/i.test(e.message)) {\n    await sleep(2000);\n    return svc.registerClient(region);\n  }\n  throw e;\n}","preventionTips":["Always pass a region validated by assertValidAwsRegion (or omit it to use the default us-east-1).","Back off and retry on 429/throttling bodies; fail fast on 4xx auth errors.","Log the raw response body — the AWS error code pinpoints whether the problem is region, payload, or outage.","Check corporate proxy rules for oidc.<region>.amazonaws.com before deploying."],"tags":["oauth","aws","oidc","network","device-flow"],"backgroundTag":"oauth-upstream-error","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}