{"record":{"id":"6bd4982968191fb1","repo":"nexu-io/open-design","slug":"token-endpoint-response-missing-access-token","errorCode":null,"errorMessage":"token endpoint response missing access_token","messagePattern":"token endpoint response missing access_token","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/daemon/src/mcp-oauth.ts","lineNumber":430,"sourceCode":"    // client_id we already put in the form. Public clients (PKCE-only)\n    // skip this branch.\n    const basic = Buffer.from(`${form.get('client_id')}:${clientSecret}`).toString('base64');\n    headers['authorization'] = `Basic ${basic}`;\n  }\n  const res = await fetchImpl(tokenEndpoint, {\n    method: 'POST',\n    headers,\n    body: form.toString(),\n  });\n  if (!res.ok) {\n    const txt = await safeText(res);\n    throw new Error(\n      `token endpoint rejected request: HTTP ${res.status} ${res.statusText} ${txt}`,\n    );\n  }\n  const json = (await res.json()) as OAuthTokenResponse;\n  if (!json.access_token) {\n    throw new Error('token endpoint response missing access_token');\n  }\n  return json;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    const t = await res.text();\n    return t.slice(0, 500);\n  } catch {\n    return '';\n  }\n}\n\n// ───────────────────────────────────────────────────────────────────────\n// In-memory pending-state cache.\n// ───────────────────────────────────────────────────────────────────────\n\n/**","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/nexu-io/open-design/blob/5be4028344c2eb4c667c5a97bda8f750c5597ef7/apps/daemon/src/mcp-oauth.ts#L412-L448","documentation":"exchangeCodeForToken received a 2xx but the JSON body has no access_token, which a conformant token endpoint must return. Its absence on a success status means a non-standard, errored, or envelope-wrapped response.","triggerScenarios":"Provider returned 200 with an error body; returned a wrapped or envelope schema; returned a refresh-only or empty payload.","commonSituations":"A non-conformant provider; an intermediate proxy rewrote the response.","solutions":["Inspect the raw token response body.","If the provider wraps tokens, add compatibility handling or pre-register a client.","Confirm you are hitting the true token_endpoint."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await exchangeCodeForToken(tokenEndpoint, params);\n} catch (e) {\n  if (/missing access_token/i.test(e.message)) {\n    // inspect raw token body; restart beginAuth if the response is malformed\n    return beginAuth(input);\n  }\n  throw e;\n}","preventionTips":["Smoke-test the token endpoint shape against each provider.","Restart beginAuth on malformed token responses.","Confirm the endpoint is the true token_endpoint from metadata."],"tags":["oauth","token","protocol"],"backgroundTag":null,"analyzedSha":"5be4028344c2eb4c667c5a97bda8f750c5597ef7","analyzedAt":"2026-08-12T12:03:58.812Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}