{"record":{"id":"b17fa978d32e4720","repo":"langgenius/dify","slug":"code-is-required","errorCode":null,"errorMessage":"code is required","messagePattern":"code is required","errorType":"http","errorClass":"BadRequest","httpStatus":400,"severity":"error","filePath":"api/controllers/console/auth/oauth_server.py","lineNumber":208,"sourceCode":"        )\n\n\n@console_ns.route(\"/oauth/provider/token\")\nclass OAuthServerUserTokenApi(Resource):\n    @setup_required\n    @console_ns.expect(console_ns.models[OAuthTokenRequest.__name__])\n    @console_ns.response(200, \"Success\", console_ns.models[OAuthProviderTokenResponse.__name__])\n    @oauth_server_client_id_required\n    @model_validate(OAuthTokenRequest)\n    def post(self, payload: OAuthTokenRequest, oauth_provider_app: OAuthProviderApp):\n        try:\n            grant_type = OAuthGrantType(payload.grant_type)\n        except ValueError:\n            raise BadRequest(\"invalid grant_type\")\n        match grant_type:\n            case OAuthGrantType.AUTHORIZATION_CODE:\n                if not payload.code:\n                    raise BadRequest(\"code is required\")\n\n                if payload.client_secret != oauth_provider_app.client_secret:\n                    raise BadRequest(\"client_secret is invalid\")\n\n                if payload.redirect_uri not in oauth_provider_app.redirect_uris:\n                    raise BadRequest(\"redirect_uri is invalid\")\n\n                access_token, refresh_token = OAuthServerService.sign_oauth_access_token(\n                    grant_type, code=payload.code, client_id=oauth_provider_app.client_id\n                )\n                return jsonable_encoder(\n                    {\n                        \"access_token\": access_token,\n                        \"token_type\": \"Bearer\",\n                        \"expires_in\": OAUTH_ACCESS_TOKEN_EXPIRES_IN,\n                        \"refresh_token\": refresh_token,\n                    }\n                )","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/oauth_server.py#L190-L226","documentation":"Flask BadRequest (HTTP 400) at oauth_server.py:208 in the AUTHORIZATION_CODE branch of the token endpoint. The grant_type was valid but payload.code is empty/None, so there is no authorization code to exchange. Raised before client_secret and redirect_uri are checked.","triggerScenarios":"POST /oauth/provider/token with grant_type=authorization_code but the code field omitted or empty. Typically the client forgot to include the code returned by /oauth/provider/authorize, or the code variable was never populated.","commonSituations":"Client lost the authorization code between the authorize step and the token step (page reload, expired state), or wired the flow incorrectly and posts an empty code.","solutions":["First call POST /oauth/provider/authorize to obtain a code, then pass that exact code in the token request.","Inspect the token request body to confirm the code field is populated and non-empty before sending.","Handle the authorize-step response carefully so the code is not overwritten or dropped before the token call."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (grantType === 'authorization_code' && !code) {\n  throw new Error('Obtain a code from /oauth/provider/authorize first');\n}","typeGuard":"function hasCode(p: {code?: string}): boolean { return typeof p.code === 'string' && p.code.length > 0; }","tryCatchPattern":"try {\n  await exchangeCodeForToken(code, clientId, clientSecret, redirectUri);\n} catch (e) {\n  if (/code is required/i.test(e.message)) { reRunAuthorize(); } else throw e;\n}","preventionTips":["Always call authorize before token; pass the returned code unchanged.","Do not log or truncate the code in transit.","Validate the code field is non-empty before posting."],"tags":["oauth-server","authorization-code","token","validation"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}