{"record":{"id":"936d2e9c3a3ff53f","repo":"chenhg5/cc-connect","slug":"s-fetch-tenant-access-token-code-d-msg-s","errorCode":null,"errorMessage":"%s: fetch tenant access token code=%d msg=%s","messagePattern":"(.+?): fetch tenant access token code=(.+?) msg=(.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/feishu/feishu.go","lineNumber":4112,"sourceCode":"\tfreshToken, refreshErr := p.fetchFreshTenantAccessToken(ctx)\n\tif refreshErr != nil {\n\t\treturn fmt.Errorf(\"%s: %s failed after token refresh attempt: %w (original error: %v)\", p.tag(), operation, refreshErr, err)\n\t}\n\n\tslog.Warn(p.tag()+\": retrying request with fresh tenant access token\", \"operation\", operation)\n\treturn fn(p.replayAPIClient(), larkcore.WithTenantAccessToken(freshToken))\n}\n\nfunc (p *Platform) fetchFreshTenantAccessToken(ctx context.Context) (string, error) {\n\tresp, err := p.replayAPIClient().GetTenantAccessTokenBySelfBuiltApp(ctx, &larkcore.SelfBuiltTenantAccessTokenReq{\n\t\tAppID:     p.appID,\n\t\tAppSecret: p.appSecret,\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: fetch tenant access token: %w\", p.tag(), err)\n\t}\n\tif !resp.Success() {\n\t\treturn \"\", fmt.Errorf(\"%s: fetch tenant access token code=%d msg=%s\", p.tag(), resp.Code, resp.Msg)\n\t}\n\tif strings.TrimSpace(resp.TenantAccessToken) == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s: fetch tenant access token returned empty token\", p.tag())\n\t}\n\treturn resp.TenantAccessToken, nil\n}\n\nfunc (p *Platform) replayAPIClient() *lark.Client {\n\tp.replayClientMu.Lock()\n\tdefer p.replayClientMu.Unlock()\n\tif p.replayClient == nil {\n\t\tp.replayClient = newFeishuReplayClient(p.appID, p.appSecret, p.domain)\n\t}\n\treturn p.replayClient\n}\n\nfunc newFeishuReplayClient(appID, appSecret, domain string) *lark.Client {\n\tvar opts []lark.ClientOptionFunc","sourceCodeStart":4094,"sourceCodeEnd":4130,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/feishu/feishu.go#L4094-L4130","documentation":"The tenant_access_token request completed but Feishu returned a business error (resp.Success()==false); the Feishu error code and message are included. This typically indicates the app credentials were rejected during token issuance.","triggerScenarios":"GetTenantAccessTokenBySelfBuiltApp returns a response with code != 0 — most commonly code 10003 (invalid app_id) or 10004 (invalid app_secret) — during the token-refresh retry path.","commonSituations":"Wrong or rotated app_secret in config.toml, app deleted/disabled in the Feishu developer console, using a Lark (open.larksuite.com) app against Feishu endpoints or vice versa, or store-app credentials used with a self-built token endpoint.","solutions":["Look up the embedded code in Feishu docs — 10003/10004 mean credentials are wrong.","Re-copy app_id/app_secret from the Feishu developer console into config.toml and restart.","Confirm the app type (self-built vs store) matches the token endpoint being used.","Verify the correct domain (Feishu vs Lark) matches where the app is registered."],"exampleFix":"// before\nappSecret = \"old-secret\"\n// after\n# config.toml\n[platforms.feishu]\napp_id = \"cli_xxx\"\napp_secret = \"<current secret from developer console>\"","handlingStrategy":"try-catch","validationCode":"// verify credentials before deploying\ntoken, err := fetchFreshTenantAccessToken(ctx)\nif err != nil && strings.Contains(err.Error(), \"code=10003\") {\n\treturn errors.New(\"invalid app_id\")\n}","typeGuard":null,"tryCatchPattern":"token, err := p.fetchFreshTenantAccessToken(ctx)\nif err != nil {\n\tvar code int\n\tif extractFeishuCode(err, &code) && (code == 10003 || code == 10004) {\n\t\treturn fmt.Errorf(\"feishu credentials rejected (code=%d): fix config.toml\", code)\n\t}\n\treturn err\n}","preventionTips":["Copy app_id/app_secret directly from the developer console; never hand-type.","Fail fast at startup with a credential smoke test.","Keep the Feishu vs Lark domain consistent with where the app is registered.","Rotate secrets via config update + restart, alerting on refresh failures during the window."],"tags":["feishu","lark","auth","token","credentials"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}