{"record":{"id":"dda65add5d3acdb6","repo":"paperclipai/paperclip","slug":"oauth-token-exchange-failed","errorCode":"oauth_token_exchange_failed","errorMessage":"OAuth token exchange failed","messagePattern":"OAuth token exchange failed","errorType":"http","errorClass":"HttpError","httpStatus":502,"severity":"error","filePath":"server/src/services/tool-access.ts","lineNumber":4605,"sourceCode":"        // one credential a caller could still present.\n        await db\n          .update(toolProfiles)\n          .set({ status: \"archived\", defaultAction: \"deny\", updatedAt: now })\n          .where(eq(toolProfiles.id, appProfile.id));\n        appProfileOutcome = \"archived\";\n        const revokedTokens = await db\n          .update(toolMcpGatewayTokens)\n          .set({ revokedAt: now, updatedAt: now })\n          .where(and(\n            eq(toolMcpGatewayTokens.companyId, connection.companyId),\n            inArray(toolMcpGatewayTokens.gatewayId, gatewayRows.map((row) => row.id)),\n            isNull(toolMcpGatewayTokens.revokedAt),\n          ))\n          .returning({ id: toolMcpGatewayTokens.id });\n        gatewayTokensRevoked = revokedTokens.length;\n        if (revokedTokens.length > 0) {\n          gatewaySessionsRevoked = (await db\n            .update(toolGatewaySessions)\n            .set({ revokedAt: now, updatedAt: now })\n            .where(and(\n              eq(toolGatewaySessions.companyId, connection.companyId),\n              inArray(toolGatewaySessions.gatewayTokenId, revokedTokens.map((row) => row.id)),\n              isNull(toolGatewaySessions.revokedAt),\n            ))\n            .returning({ id: toolGatewaySessions.id })).length;\n        }\n      }\n    }\n\n    // A local runtime already holds the injected credential inside a live child\n    // process, so archiving rows is not enough — the process itself is an access\n    // path. Stopping is best effort on purpose: if the supervisor cannot be\n    // reached, revoking the credential anyway (so nothing can start again) beats\n    // abandoning the teardown, and the warning says which slot was left running.\n    let runtimeSlotsStopped = 0;\n    const runtimeSlotRows = await db","sourceCodeStart":4587,"sourceCodeEnd":4623,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-access.ts#L4587-L4623","documentation":"Generic OAuth token-exchange failure: the token endpoint returned non-2xx (or ok:false) and the grant was not a recoverable invalid_grant. Wrapped as HttpError 502 with providerError/status for diagnostics; the provider's token endpoint is at fault.","triggerScenarios":"Thrown at server/src/services/tool-access.ts:4447 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The token exchange with the provider failed. Verify client credentials, redirect URI match, and provider availability, then reconnect the app."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}