bytebase/bytebase · error

missing "access_token" from authorization response

Error message

missing "access_token" from authorization response

What it means

OAuth2 provider ExchangeToken: the token exchange with the issuer succeeded but the returned token payload lacks a usable string access_token field. The provider's response does not conform to OAuth2, so no access token can be extracted for API calls.

Source

Thrown at backend/plugin/idp/oauth2/oauth2.go:83

		Scopes:       p.config.Scopes,
		Endpoint: oauth2.Endpoint{
			AuthURL:   p.config.AuthUrl,
			TokenURL:  p.config.TokenUrl,
			AuthStyle: authStyle,
		},
	}

	ctx = context.WithValue(ctx, oauth2.HTTPClient, p.client)
	token, err := conf.Exchange(ctx, code)
	if err != nil {
		slog.Error("Failed to exchange access token", slog.String("code", code), log.BBError(err))
		return "", errors.Wrap(err, "failed to exchange access token")
	}

	accessToken, ok := token.Extra("access_token").(string)
	if !ok {
		slog.Error(`Missing "access_token" from authorization response`, slog.String("code", code), slog.Any("token", token))
		return "", errors.New(`missing "access_token" from authorization response`)
	}

	return accessToken, nil
}

// UserInfo returns the parsed user information using the given OAuth2 token.
func (p *IdentityProvider) UserInfo(token string) (*storepb.IdentityProviderUserInfo, map[string]any, error) {
	req, err := http.NewRequest(http.MethodGet, p.config.UserInfoUrl, nil)
	if err != nil {
		return nil, nil, errors.Wrap(err, "failed to new http request")
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	resp, err := p.client.Do(req)
	if err != nil {
		slog.Error("Failed to get user information", slog.String("token", token), log.BBError(err))
		return nil, nil, errors.Wrap(err, "failed to get user information")
	}
	defer resp.Body.Close()

View on GitHub (pinned to 1870550677)

Solutions

1. Verify the IdP token endpoint and client configuration
2. Check the IdP returns access_token in the token response
3. Inspect server logs for the underlying exchange response

When it happens

Trigger: Thrown at backend/plugin/idp/oauth2/oauth2.go:83 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/730fa76df7b441b2. Report an issue: GitHub.