{"record":{"id":"95d173ad2ded694a","repo":"ToolJet/ToolJet","slug":"access-token-not-found-in-the-response","errorCode":null,"errorMessage":"access_token not found in the response","messagePattern":"access_token not found in the response","errorType":"exception","errorClass":"QueryError","httpStatus":null,"severity":"error","filePath":"marketplace/plugins/common/lib/oauth.ts","lineNumber":344,"sourceCode":"  if (!(response.statusCode >= 200 || response.statusCode < 300)) {\n    throw new QueryError(\n      'could not connect to Oauth server. status code',\n      JSON.stringify({ statusCode: response.statusCode }),\n      {\n        responseObject: {\n          statusCode: response.statusCode,\n          responseBody: response.body,\n        },\n        responseHeaders: response.headers,\n      }\n    );\n  }\n\n  if (result['access_token']) {\n    accessTokenDetails['access_token'] = result['access_token'];\n    accessTokenDetails['refresh_token'] = result['refresh_token'] || refreshToken;\n  } else {\n    throw new QueryError(\n      'access_token not found in the response',\n      {},\n      {\n        responseObject: {\n          statusCode: response.statusCode,\n          responseBody: response.body,\n        },\n        responseHeaders: response.headers,\n      }\n    );\n  }\n  return accessTokenDetails;\n};\n","sourceCodeStart":326,"sourceCodeEnd":358,"githubUrl":"https://github.com/ToolJet/ToolJet/blob/20602a8e101f2e59686c9afde0d1402aac2c8871/marketplace/plugins/common/lib/oauth.ts#L326-L358","documentation":"Thrown after a successful (2xx) refresh-token response when the parsed body has no access_token field. The data payload includes the responseObject and responseHeaders so the caller can see exactly what the IdP returned. It indicates the IdP accepted the request but returned a body shape this code does not recognize as a valid token response.","triggerScenarios":"result = JSON.parse(response.body) succeeds but result['access_token'] is falsy. Causes: the IdP returned an error envelope with 200 status; the refresh_token grant is not enabled on the app registration; the response nests the token under a different key (e.g., data.access_token); the response is a non-token JSON object (rate-limit notice, consent required).","commonSituations":"Custom/private IdPs with non-standard token envelopes; app registration missing the refresh_token grant type; the consent screen was skipped and the IdP returned a 200 with an error body; the wrong access_token_url was used (hit a different endpoint that returns JSON without access_token).","solutions":["Inspect error.data.responseObject.responseBody to see the actual IdP response body and compare it to the expected OAuth2 token shape.","If the token is nested (e.g., under data or result), the IdP is non-compliant; you need adapter code or the correct endpoint.","On the IdP admin side, enable the refresh_token grant and the offline_access equivalent scope for this app.","Confirm access_token_url points to the token endpoint, not the authorize or userinfo endpoint.","Re-authorize if the IdP requires periodic re-consent and returned a 200 'consent_required' envelope."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"function hasAccessToken(body: any): boolean {\n  return body != null && typeof body.access_token === 'string' && body.access_token.length > 0;\n}\n// after the refresh response, before trusting it:\nif (!hasAccessToken(result)) { /* surface IdP response body for diagnosis */ }","typeGuard":"function isTokenResponse(o: any): o is { access_token: string; refresh_token?: string } {\n  return o != null && typeof o.access_token === 'string' && o.access_token.length > 0;\n}","tryCatchPattern":"try { await getRefreshedToken(...); }\ncatch (e) {\n  if (e instanceof QueryError && e.message === 'access_token not found in the response') {\n    // e.data.responseObject.responseBody shows what the IdP actually returned; likely needs IdP config fix\n  }\n  throw e;\n}","preventionTips":["Verify the IdP app registration has the refresh_token grant enabled.","Confirm access_token_url is the token endpoint, not authorize/userinfo.","Log the response body when access_token is absent so non-standard envelopes are diagnosable."],"tags":["oauth","refresh-token","response-shape","configuration","typescript"],"backgroundTag":null,"analyzedSha":"20602a8e101f2e59686c9afde0d1402aac2c8871","analyzedAt":"2026-08-13T05:58:54.221Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}