{"record":{"id":"730fa76df7b441b2","repo":"bytebase/bytebase","slug":"missing-access-token-from-authorization-response","errorCode":null,"errorMessage":"missing \"access_token\" from authorization response","messagePattern":"missing \"access_token\" from authorization response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/plugin/idp/oauth2/oauth2.go","lineNumber":83,"sourceCode":"\t\tScopes:       p.config.Scopes,\n\t\tEndpoint: oauth2.Endpoint{\n\t\t\tAuthURL:   p.config.AuthUrl,\n\t\t\tTokenURL:  p.config.TokenUrl,\n\t\t\tAuthStyle: authStyle,\n\t\t},\n\t}\n\n\tctx = context.WithValue(ctx, oauth2.HTTPClient, p.client)\n\ttoken, err := conf.Exchange(ctx, code)\n\tif err != nil {\n\t\tslog.Error(\"Failed to exchange access token\", slog.String(\"code\", code), log.BBError(err))\n\t\treturn \"\", errors.Wrap(err, \"failed to exchange access token\")\n\t}\n\n\taccessToken, ok := token.Extra(\"access_token\").(string)\n\tif !ok {\n\t\tslog.Error(`Missing \"access_token\" from authorization response`, slog.String(\"code\", code), slog.Any(\"token\", token))\n\t\treturn \"\", errors.New(`missing \"access_token\" from authorization response`)\n\t}\n\n\treturn accessToken, nil\n}\n\n// UserInfo returns the parsed user information using the given OAuth2 token.\nfunc (p *IdentityProvider) UserInfo(token string) (*storepb.IdentityProviderUserInfo, map[string]any, error) {\n\treq, err := http.NewRequest(http.MethodGet, p.config.UserInfoUrl, nil)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"failed to new http request\")\n\t}\n\treq.Header.Set(\"Authorization\", fmt.Sprintf(\"Bearer %s\", token))\n\tresp, err := p.client.Do(req)\n\tif err != nil {\n\t\tslog.Error(\"Failed to get user information\", slog.String(\"token\", token), log.BBError(err))\n\t\treturn nil, nil, errors.Wrap(err, \"failed to get user information\")\n\t}\n\tdefer resp.Body.Close()","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/plugin/idp/oauth2/oauth2.go#L65-L101","documentation":"OAuth2 provider ExchangeToken: the token exchange with the issuer succeeded but the returned token payload lacks a usable string access_token field. The provider's response does not conform to OAuth2, so no access token can be extracted for API calls.","triggerScenarios":"Thrown at backend/plugin/idp/oauth2/oauth2.go:83 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the IdP token endpoint and client configuration","Check the IdP returns access_token in the token response","Inspect server logs for the underlying exchange response"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}