{"record":{"id":"bafec360a60107c4","repo":"diegosouzapw/OmniRoute","slug":"token-refresh-failed-error","errorCode":null,"errorMessage":"Token refresh failed: ${error}","messagePattern":"Token refresh failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/kiro.ts","lineNumber":210,"sourceCode":"    const { authMethod, clientId, clientSecret, region } = providerSpecificData;\n\n    // Enterprise / Microsoft Entra \"Your organization\" (external_idp) login: refresh with a\n    // standard public-client OAuth2 refresh_token grant against the org IdP's tokenEndpoint\n    // (form-encoded client_id + refresh_token + scope, no client_secret). The AWS SSO OIDC and\n    // Kiro social endpoints cannot refresh these tokens.\n    if (isExternalIdpAuthMethod(authMethod)) {\n      const refreshRequest = buildExternalIdpRefreshParams(refreshToken, providerSpecificData);\n      const response = await fetch(refreshRequest.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/x-www-form-urlencoded\",\n          Accept: \"application/json\",\n        },\n        body: refreshRequest.body,\n      });\n      if (!response.ok) {\n        const error = await response.text();\n        throw new Error(`Token refresh failed: ${error}`);\n      }\n      const data = await response.json();\n      return {\n        accessToken: data.access_token,\n        refreshToken: data.refresh_token || refreshToken,\n        expiresIn: data.expires_in || 3600,\n      };\n    }\n\n    // AWS SSO OIDC refresh (Builder ID or IDC).\n    // Imported social tokens (authMethod === \"imported\") have a registered clientId/clientSecret\n    // but a Kiro-social refresh token the OIDC client can't refresh — use the social path (#2467).\n    if (clientId && clientSecret && authMethod !== \"imported\") {\n      const resolvedRegion = region || \"us-east-1\";\n      assertValidAwsRegion(resolvedRegion);\n      const endpoint = `https://oidc.${resolvedRegion}.amazonaws.com/token`;\n\n      const response = await fetch(endpoint, {","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/oauth/services/kiro.ts#L192-L228","documentation":"KiroService.refreshToken: a refresh attempt failed on the primary path (AWS SSO OIDC or social endpoint, or the external-IdP refresh endpoint for Entra logins) and the error text is wrapped. Because refreshing with stored credentials failed, it signals an expired/revoked refresh token, an unregistered client, or an upstream outage; the flow may then attempt re-registration.","triggerScenarios":"Thrown at src/lib/oauth/services/kiro.ts:210 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Read the wrapped error to distinguish invalid_grant (needs re-auth) from throttling/5xx (retry)","For external_idp authMethod, verify the org IdP tokenEndpoint and public-client refresh parameters","If refresh token is revoked, mark the connection expired and prompt re-authorization","Retry with backoff on transient AWS errors"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}