{"record":{"id":"c9f87bb5a1cfcb49","repo":"diegosouzapw/OmniRoute","slug":"invalid-token-format-token-should-start-with-aora","errorCode":null,"errorMessage":"Invalid token format. Token should start with aorAAAAAG...","messagePattern":"Invalid token format\\. Token should start with aorAAAAAG\\.\\.\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/kiro.ts","lineNumber":332,"sourceCode":"      expiresIn: data.expiresIn || 3600,\n    };\n  }\n\n  /**\n   * Validate and import refresh token.\n   * First attempts to validate using cached AWS SSO client credentials (Builder ID path).\n   * If that fails or no cached credentials exist, registers a dedicated OIDC client.\n   * If registerClient() also fails, the import falls back to the shared social-auth refresh path.\n   */\n  async validateImportToken(\n    refreshToken: string,\n    region: string = \"us-east-1\",\n    clientIdHint?: string\n  ) {\n    assertValidAwsRegion(region);\n    // Validate token format\n    if (!refreshToken.startsWith(\"aorAAAAAG\")) {\n      throw new Error(\"Invalid token format. Token should start with aorAAAAAG...\");\n    }\n\n    // Try to read cached clientId/clientSecret from AWS SSO cache (Builder ID tokens).\n    // When the caller knows the token's own clientId (#1253 — e.g. surfaced by\n    // auto-import from a direct `clientId` field on the token file), pass it\n    // through so the cache lookup can match it exactly instead of guessing via\n    // region + latest-expiry, which can silently adopt an unrelated stale\n    // client registration on hosts with multiple cached SSO sessions.\n    const cachedClient = await this.readCachedClientCredentials(region, clientIdHint);\n\n    // Attempt 1: Try Builder ID refresh using cached credentials\n    if (cachedClient) {\n      try {\n        const result = await this.refreshToken(refreshToken, {\n          clientId: cachedClient.clientId,\n          clientSecret: cachedClient.clientSecret,\n          authMethod: \"builder-id\",\n          // Forward the requested region so a non-us-east-1 Builder ID validates","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/oauth/services/kiro.ts#L314-L350","documentation":"Error \"Invalid token format. Token should start with aorAAAAAG...\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/oauth/services/kiro.ts:332 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}