calcom/cal.diy · error · Error

Could not refresh the token due to connection issue with the

Error message

Could not refresh the token due to connection issue with the endpoint: ${CREDENTIAL_SYNC_ENDPOINT}

What it means

Thrown by OAuthManager.refreshOAuthToken when the credential-sync mode is active and the fetch to CREDENTIAL_SYNC_ENDPOINT itself rejects (network-level error), not an HTTP error response. The catch wraps the raw fetch failure and re-throws a descriptive Error naming the unreachable endpoint. A non-OK HTTP response would not trigger this (that path is handled separately).

Source

Thrown at packages/app-store/_utils/oauth/OAuthManager.ts:506

          endpoint: CREDENTIAL_SYNC_ENDPOINT,
        })
      );

      try {
        response = await fetch(`${this.credentialSyncVariables.CREDENTIAL_SYNC_ENDPOINT}`, {
          method: "POST",
          headers: {
            [this.credentialSyncVariables.CREDENTIAL_SYNC_SECRET_HEADER_NAME]:
              this.credentialSyncVariables.CREDENTIAL_SYNC_SECRET,
          },
          body: new URLSearchParams({
            calcomUserId: this.resourceOwner.id.toString(),
            appSlug: this.appSlug,
          }),
        });
      } catch (e) {
        myLog.error("Could not refresh the token.", safeStringify(e));
        throw new Error(
          `Could not refresh the token due to connection issue with the endpoint: ${CREDENTIAL_SYNC_ENDPOINT}`
        );
      }
    } else {
      myLog.info(
        "Refreshing OAuth token",
        safeStringify({
          appSlug: this.appSlug,
          resourceOwner: this.resourceOwner,
        })
      );
      try {
        response = await this.fetchNewTokenObject({ refreshToken });
      } catch (e) {
        response = handleFetchError(e);
      }
      if (!response) {
        throw new Error("`fetchNewTokenObject` could not refresh the token");

View on GitHub (pinned to 176037d0af)

Solutions

Verify CREDENTIAL_SYNC_ENDPOINT is reachable from the Cal.com server (curl it from the same host/network).
Start the credential-sync server and ensure it is listening on the configured host/port.
Fix the endpoint URL scheme/host/port if mistyped.
Resolve DNS/TLS/firewall issues blocking the egress, then the next token refresh will succeed.

Example fix

// before
CALCOM_CREDENTIAL_SYNC_ENDPOINT=https://sync.internal/local
// after - correct reachable endpoint
CALCOM_CREDENTIAL_SYNC_ENDPOINT=https://sync.internal.example.com/api/getToken

Defensive patterns

Strategy: retry

Validate before calling

import { CREDENTIAL_SYNC_ENDPOINT } from '@calcom/lib/constants';
// preflight: confirm the endpoint resolves before relying on it
try {
  await fetch(CREDENTIAL_SYNC_ENDPOINT, { method: 'HEAD' });
} catch {
  throw new Error(`Credential sync endpoint unreachable: ${CREDENTIAL_SYNC_ENDPOINT}`);
}

Type guard

null

Try / catch

for (let attempt = 1; attempt <= 3; attempt++) {
  try {
    response = await fetch(CREDENTIAL_SYNC_ENDPOINT, { method: 'POST', ... });
    break;
  } catch (e) {
    if (attempt === 3) throw new Error(`Sync endpoint unreachable after retries: ${e.message}`);
  }
}

Prevention

Verify CREDENTIAL_SYNC_ENDPOINT is reachable from the Cal.com server host.
Keep the credential-sync server running and healthy in production.
Use short retry with backoff for transient network failures before surfacing the error.

When it happens

Trigger: APP_CREDENTIAL_SHARING_ENABLED is on, CREDENTIAL_SYNC_ENDPOINT/SECRET/HEADER are set, resourceOwner.id is present, and fetch() to the sync endpoint throws — DNS failure, connection refused, TLS error, timeout, or the endpoint host being down.

Common situations: CREDENTIAL_SYNC_ENDPOINT points to a wrong/unreachable host; the credential-sync server is down; firewall/network policy blocks the egress; TLS cert invalid; endpoint URL has a typo (e.g. missing http/https); local dev without the sync server running.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/b7029f7859f857d9. Report an issue: GitHub.