{"record":{"id":"ef8fbc8be227b8a6","repo":"crewAIInc/crewAI","slug":"invalid-json-response-from-oauth-endpoint","errorCode":null,"errorMessage":"Invalid JSON response from {oauth_endpoint}","messagePattern":"Invalid JSON response from (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/cli/src/crewai_cli/enterprise/main.py","lineNumber":56,"sourceCode":"            raise SystemExit(1) from e\n\n    def _fetch_oauth_config(self, enterprise_url: str) -> dict[str, Any]:\n        oauth_endpoint = f\"{enterprise_url}/auth/parameters\"\n\n        try:\n            console.print(f\"🔄 Fetching OAuth2 configuration from {oauth_endpoint}...\")\n            headers = {\n                \"Content-Type\": \"application/json\",\n                \"User-Agent\": f\"CrewAI-CLI/{get_crewai_version()}\",\n                \"X-Crewai-Version\": get_crewai_version(),\n            }\n            response = httpx.get(oauth_endpoint, timeout=30, headers=headers)\n            response.raise_for_status()\n\n            try:\n                oauth_config = response.json()\n            except json.JSONDecodeError as e:\n                raise ValueError(f\"Invalid JSON response from {oauth_endpoint}\") from e\n\n            self._validate_oauth_config(oauth_config)\n\n            console.print(\n                \"✅ Successfully retrieved OAuth2 configuration\", style=\"green\"\n            )\n            return cast(dict[str, Any], oauth_config)\n\n        except httpx.HTTPError as e:\n            raise ValueError(f\"Failed to connect to enterprise URL: {e!s}\") from e\n        except Exception as e:\n            raise ValueError(f\"Error fetching OAuth2 configuration: {e!s}\") from e\n\n    def _update_oauth_settings(\n        self, enterprise_url: str, oauth_config: dict[str, Any]\n    ) -> None:\n        try:\n            config_mapping = {","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/cli/src/crewai_cli/enterprise/main.py#L38-L74","documentation":"Raised during enterprise onboarding (`crewai enterprise connect` style flow) when the OAuth2 discovery endpoint returns HTTP 200 but a body that is not valid JSON. The CLI fetches {enterprise_url}/.../oauth config with httpx, calls response.json(), and json.JSONDecodeError is re-raised as ValueError with the offending URL. It indicates the endpoint replied with HTML/plain text instead of a JSON document.","triggerScenarios":"Passing an enterprise URL that serves an HTML login page or proxy error page at the OAuth discovery path; a reverse proxy or captive portal intercepting the request; a wrong scheme/port so a different service answers; trailing-slash or path mistakes making the constructed oauth_endpoint point at a non-API route.","commonSituations":"Corporate proxies that rewrite responses, misconfigured enterprise base URL (e.g. including /auth twice, or http vs https), CDN/WAF challenge pages (Cloudflare interstitials), or the enterprise server being upgraded and temporarily serving maintenance HTML.","solutions":["curl the oauth_endpoint URL directly (e.g. curl -H 'Accept: application/json' <url>) and confirm it returns JSON","Fix the enterprise base URL: correct scheme, host, port, and no duplicated path segments","If a proxy/WAF is involved, allowlist the CLI's User-Agent (CrewAI-CLI/<version>) or bypass the proxy for that host","Check the enterprise server logs to confirm the OAuth discovery route is enabled and healthy"],"exampleFix":"# before\ncrewai enterprise connect https://acme.internal/auth/auth\n# after (base URL only; CLI derives the discovery path)\ncrewai enterprise connect https://acme.internal","handlingStrategy":"try-catch","validationCode":"import httpx, json\n\ndef discovery_returns_json(url: str) -> bool:\n    r = httpx.get(url, timeout=30, headers={\"Accept\": \"application/json\"})\n    r.raise_for_status()\n    try:\n        return isinstance(r.json(), dict)\n    except json.JSONDecodeError:\n        return False","typeGuard":"def is_oauth_config(value: object) -> bool:\n    required = {\"audience\", \"domain\", \"provider\", \"device_authorization_client_id\", \"extra\"}\n    return isinstance(value, dict) and required.issubset(value)","tryCatchPattern":"try:\n    enterprise_cmd.connect(url)\nexcept ValueError as e:\n    if str(e).startswith(\"Invalid JSON response\"):\n        # endpoint served non-JSON; inspect with curl, fix URL/proxy\n        ...","preventionTips":["Verify the discovery URL with curl -H 'Accept: application/json' before running connect","Give only the enterprise base URL and let the CLI build the endpoint path","Bypass HTML-serving proxies/WAFs for the enterprise host"],"tags":["network","oauth","enterprise","json"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}