{"record":{"id":"9b7a98da303b4204","repo":"diegosouzapw/OmniRoute","slug":"client-registration-failed-error","errorCode":null,"errorMessage":"Client registration failed: ${error}","messagePattern":"Client registration failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/providers/kiro.ts","lineNumber":44,"sourceCode":"    // For enterprise IDC custom startUrl flows, issuerUrl can differ per tenant.\n    // Sending a fixed issuerUrl often causes invalid_request during device auth.\n    if (config.issuerUrl && !config.skipIssuerUrlForRegistration) {\n      registerPayload.issuerUrl = config.issuerUrl;\n    }\n\n    // Step 1: Register client with AWS SSO OIDC\n    const registerRes = await fetch(config.registerClientUrl, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n      body: JSON.stringify(registerPayload),\n    });\n\n    if (!registerRes.ok) {\n      const error = await registerRes.text();\n      throw new Error(`Client registration failed: ${error}`);\n    }\n\n    const clientInfo = await registerRes.json();\n\n    // Step 2: Request device authorization\n    const deviceRes = await fetch(config.deviceAuthUrl, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n      body: JSON.stringify({\n        clientId: clientInfo.clientId,\n        clientSecret: clientInfo.clientSecret,\n        startUrl: config.startUrl,\n      }),\n    });\n","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/oauth/providers/kiro.ts#L26-L62","documentation":"Step 1 of Kiro's OAuth flow: the AWS SSO OIDC client-registration call (registerClientUrl POST) returned non-ok; the raw body is appended. The registerPayload may include issuerUrl only for non-IDC flows (it is deliberately skipped for enterprise IDC tenants to avoid invalid_request). Failure means AWS SSO rejected the client registration — often a bad issuerUrl/startUrl combination or an AWS-side error.","triggerScenarios":"Thrown at src/lib/oauth/providers/kiro.ts:44 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Read the appended AWS error body (e.g. InvalidRequestException, unauthorizedClient)","For enterprise IDC startUrls, ensure skipIssuerUrlForRegistration is set so a fixed issuerUrl is not sent","Verify issuerUrl matches the tenant's actual identity store issuer","Retry on transient AWS 5xx with backoff"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}