{"record":{"id":"ebc92fb06a642b84","repo":"different-ai/openwork","slug":"auth-token-acquisition","errorCode":"AUTH_TOKEN_ACQUISITION","errorMessage":"Token response did not match the selected provider profile","messagePattern":"Token response did not match the selected provider profile","errorType":"exception","errorClass":"ProbeFailure","httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-mock-server/src/testing/probe.ts","lineNumber":688,"sourceCode":"    if (tokenAuthMethod === \"client_secret_post\") tokenForm.set(\"client_secret\", clientSecret)\n    const tokenResponse = await expectOk(\n      await fetchStep(tokenEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: tokenForm,\n      }, \"AUTH_TOKEN_ACQUISITION\", overallDeadline),\n      \"AUTH_TOKEN_ACQUISITION\",\n    )\n    const token = parseAt(\n      tokenResponseSchema,\n      await parseJson(tokenResponse, \"AUTH_TOKEN_ACQUISITION\", \"oauth_token\"),\n      \"AUTH_TOKEN_ACQUISITION\",\n      \"oauth_token\",\n      \"Token response did not match the required shape\",\n    )\n    const expectedTokenType = profile.oauth.tokenResponseStyle === \"slack-user\" ? \"user\" : \"Bearer\"\n    if (token.token_type !== expectedTokenType || (expectedTokenType === \"user\" && token.ok !== true)) {\n      throw new ProbeFailure(\"AUTH_TOKEN_ACQUISITION\", \"oauth_token\", \"Token response did not match the selected provider profile\")\n    }\n    accessToken = token.access_token\n    refreshToken = token.refresh_token\n    sensitiveValues.push(accessToken, refreshToken)\n    recordPassed(phases, \"AUTH_TOKEN_ACQUISITION\", startedAt, \"Authorization code and PKCE token exchange passed\")\n\n    if (activeFault?.effect === \"refresh-expired\") {\n      startedAt = Date.now()\n      const refreshForm = new URLSearchParams({\n        grant_type: \"refresh_token\",\n        client_id: clientId,\n        refresh_token: refreshToken,\n      })\n      if (tokenAuthMethod === \"client_secret_post\") refreshForm.set(\"client_secret\", clientSecret)\n      const refreshResponse = await fetchStep(tokenEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: refreshForm,","sourceCodeStart":670,"sourceCodeEnd":706,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-mock-server/src/testing/probe.ts#L670-L706","documentation":"After a successful token exchange, the probe validates the token payload against the provider profile: for `tokenResponseStyle: \"slack-user\"` it requires token_type === \"user\" and ok === true; otherwise it requires token_type === \"Bearer\". A token endpoint that returns a token in the wrong style (or wrong token_type casing/value) fails profile conformance, so the probe throws AUTH_TOKEN_ACQUISITION / oauth_token.","triggerScenarios":"The token endpoint returns a JSON body whose token_type does not match the profile's expected style (e.g. \"bearer\" lowercase vs \"Bearer\", or \"user\" when Bearer is expected), or the slack-user style response has ok !== true, at probe.ts:684-686.","commonSituations":"Mock AS returning lowercase \"bearer\" while the profile expects \"Bearer\"; selecting the wrong provider profile for the target (Slack-style vs standard OAuth); a server update changing the token response shape.","solutions":["Fix the token endpoint to return token_type exactly matching the profile: \"Bearer\" for standard profiles, or token_type \"user\" with ok: true for slack-user profiles.","Select the provider profile whose tokenResponseStyle matches the actual server behavior.","Check whether a server/framework change altered token_type casing or added wrapper fields and update either side."],"exampleFix":"// before (token endpoint)\nres.json({ access_token: at, token_type: \"bearer\" })\n// after\nres.json({ access_token: at, token_type: \"Bearer\" })","handlingStrategy":"validation","validationCode":"const token = await tokenEndpointResponse.json()\nconst expected = profile.oauth.tokenResponseStyle === 'slack-user' ? 'user' : 'Bearer'\nif (token.token_type !== expected || (expected === 'user' && token.ok !== true)) {\n  throw new Error(`token_type ${token.token_type} does not match profile style ${expected}`)\n}","typeGuard":"function matchesProfileToken(t, style) { return style === 'slack-user' ? t.token_type === 'user' && t.ok === true : t.token_type === 'Bearer' }","tryCatchPattern":null,"preventionTips":["Keep token-endpoint implementations and provider-profile tokenResponseStyle in one tested contract.","Assert token_type casing in the mock AS's own unit tests.","Update profiles whenever the upstream provider changes its token response shape."],"tags":["oauth","token-response","provider-profile","contract-mismatch"],"backgroundTag":"schema-validation-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}