{"record":{"id":"86b279110dfa1169","repo":"dubinc/dub","slug":"authorization-code-not-found-please-start-the-log","errorCode":null,"errorMessage":"Authorization code not found. Please start the login process again.","messagePattern":"Authorization code not found\\. Please start the login process again\\.","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"packages/cli/src/api/callback.ts","lineNumber":35,"sourceCode":"export function oauthCallbackServer({\n  oauthClient,\n  redirectUri,\n  codeVerifier,\n  spinner,\n}: OAuthCallbackServerProps) {\n  const server = http.createServer(async (req, res) => {\n    const reqUrl = url.parse(req.url || \"\", true);\n\n    if (reqUrl.pathname !== \"/callback\" || req.method !== \"GET\") {\n      res.writeHead(404);\n      res.end(\"Not found\");\n      return;\n    }\n\n    const code = reqUrl.query.code as string;\n\n    if (!code) {\n      res.writeHead(400);\n      res.end(\n        \"Authorization code not found. Please start the login process again.\",\n      );\n\n      return;\n    }\n\n    try {\n      spinner.text = \"Verifying\";\n\n      const { accessToken, refreshToken, expiresAt } =\n        await oauthClient.authorizationCode.getToken({\n          code,\n          redirectUri,\n          codeVerifier,\n        });\n\n      spinner.text = \"Configuring\";","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/dubinc/dub/blob/f216b94a24ca5a0a48c6543ee10392c9006c8b75/packages/cli/src/api/callback.ts#L17-L53","documentation":"During the OAuth callback the server reads the `code` query parameter from the redirect request; if it is missing or empty it responds with HTTP 400 and this message. Without the authorization code the token exchange cannot proceed, so the flow is aborted and the user must restart login.","triggerScenarios":"The provider redirects to /callback without `?code=...` — e.g. the user denied consent (some providers send `error=access_denied` instead of a code), the redirect URL was edited by hand, or the provider stripped the query string.","commonSituations":"User clicking 'Cancel'/'Deny' on the consent screen, an OAuth app misconfiguration causing an error redirect, or copy-pasting a truncated URL into the browser.","solutions":["Restart the login command (`login`) to begin a fresh OAuth flow.","On the provider's consent screen, click Allow/Authorize instead of Deny.","Verify the OAuth app configuration — some setups redirect with an error parameter instead of a code; inspect the full redirect URL in the browser address bar.","Check that no browser extension or proxy is stripping query parameters from the redirect."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before starting the flow, ensure the authorize URL will include response_type=code\nconst authorizeUrl = oauthClient.authorizationCode.getAuthorizeURL({ redirectUri, scopes, codeVerifier });\nif (!authorizeUrl.includes('response_type=code')) {\n  throw new Error('Authorize URL must request response_type=code');\n}","typeGuard":"function hasAuthorizationCode(query: Record<string, unknown>): query is Record<string, string> & { code: string } {\n  return typeof query.code === 'string' && query.code.length > 0;\n}","tryCatchPattern":"// Callback side: respond 400 instead of crashing when the code is absent\nif (!hasAuthorizationCode(reqUrl.query)) {\n  res.writeHead(400);\n  res.end('Authorization code not found. Please start the login process again.');\n  return;\n}","preventionTips":["Always click Allow/Authorize on the provider consent screen; Deny often redirects without a code.","If the callback page shows this message, inspect the URL for `error=access_denied` and restart login.","Never reuse or bookmark callback URLs — codes are one-time.","Verify the OAuth app requests response_type=code."],"tags":["oauth","authorization-code","cli"],"backgroundTag":"oauth-authorization-code-missing","analyzedSha":"f216b94a24ca5a0a48c6543ee10392c9006c8b75","analyzedAt":"2026-08-31T18:35:50.395Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}