{"record":{"id":"b7029f7859f857d9","repo":"calcom/cal.diy","slug":"could-not-refresh-the-token-due-to-connection-issu","errorCode":null,"errorMessage":"Could not refresh the token due to connection issue with the endpoint: ${CREDENTIAL_SYNC_ENDPOINT}","messagePattern":"Could not refresh the token due to connection issue with the endpoint: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/app-store/_utils/oauth/OAuthManager.ts","lineNumber":506,"sourceCode":"          endpoint: CREDENTIAL_SYNC_ENDPOINT,\n        })\n      );\n\n      try {\n        response = await fetch(`${this.credentialSyncVariables.CREDENTIAL_SYNC_ENDPOINT}`, {\n          method: \"POST\",\n          headers: {\n            [this.credentialSyncVariables.CREDENTIAL_SYNC_SECRET_HEADER_NAME]:\n              this.credentialSyncVariables.CREDENTIAL_SYNC_SECRET,\n          },\n          body: new URLSearchParams({\n            calcomUserId: this.resourceOwner.id.toString(),\n            appSlug: this.appSlug,\n          }),\n        });\n      } catch (e) {\n        myLog.error(\"Could not refresh the token.\", safeStringify(e));\n        throw new Error(\n          `Could not refresh the token due to connection issue with the endpoint: ${CREDENTIAL_SYNC_ENDPOINT}`\n        );\n      }\n    } else {\n      myLog.info(\n        \"Refreshing OAuth token\",\n        safeStringify({\n          appSlug: this.appSlug,\n          resourceOwner: this.resourceOwner,\n        })\n      );\n      try {\n        response = await this.fetchNewTokenObject({ refreshToken });\n      } catch (e) {\n        response = handleFetchError(e);\n      }\n      if (!response) {\n        throw new Error(\"`fetchNewTokenObject` could not refresh the token\");","sourceCodeStart":488,"sourceCodeEnd":524,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/packages/app-store/_utils/oauth/OAuthManager.ts#L488-L524","documentation":"Thrown by OAuthManager.refreshOAuthToken when the credential-sync mode is active and the fetch to CREDENTIAL_SYNC_ENDPOINT itself rejects (network-level error), not an HTTP error response. The catch wraps the raw fetch failure and re-throws a descriptive Error naming the unreachable endpoint. A non-OK HTTP response would not trigger this (that path is handled separately).","triggerScenarios":"APP_CREDENTIAL_SHARING_ENABLED is on, CREDENTIAL_SYNC_ENDPOINT/SECRET/HEADER are set, resourceOwner.id is present, and fetch() to the sync endpoint throws — DNS failure, connection refused, TLS error, timeout, or the endpoint host being down.","commonSituations":"CREDENTIAL_SYNC_ENDPOINT points to a wrong/unreachable host; the credential-sync server is down; firewall/network policy blocks the egress; TLS cert invalid; endpoint URL has a typo (e.g. missing http/https); local dev without the sync server running.","solutions":["Verify CREDENTIAL_SYNC_ENDPOINT is reachable from the Cal.com server (curl it from the same host/network).","Start the credential-sync server and ensure it is listening on the configured host/port.","Fix the endpoint URL scheme/host/port if mistyped.","Resolve DNS/TLS/firewall issues blocking the egress, then the next token refresh will succeed."],"exampleFix":"// before\nCALCOM_CREDENTIAL_SYNC_ENDPOINT=https://sync.internal/local\n// after - correct reachable endpoint\nCALCOM_CREDENTIAL_SYNC_ENDPOINT=https://sync.internal.example.com/api/getToken","handlingStrategy":"retry","validationCode":"import { CREDENTIAL_SYNC_ENDPOINT } from '@calcom/lib/constants';\n// preflight: confirm the endpoint resolves before relying on it\ntry {\n  await fetch(CREDENTIAL_SYNC_ENDPOINT, { method: 'HEAD' });\n} catch {\n  throw new Error(`Credential sync endpoint unreachable: ${CREDENTIAL_SYNC_ENDPOINT}`);\n}","typeGuard":"null","tryCatchPattern":"for (let attempt = 1; attempt <= 3; attempt++) {\n  try {\n    response = await fetch(CREDENTIAL_SYNC_ENDPOINT, { method: 'POST', ... });\n    break;\n  } catch (e) {\n    if (attempt === 3) throw new Error(`Sync endpoint unreachable after retries: ${e.message}`);\n  }\n}","preventionTips":["Verify CREDENTIAL_SYNC_ENDPOINT is reachable from the Cal.com server host.","Keep the credential-sync server running and healthy in production.","Use short retry with backoff for transient network failures before surfacing the error."],"tags":["oauth","credential-sync","network","tokens","refresh"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}