can1357/oh-my-pi · error · AIError.OAuthError

GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw

Error message

GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}

What it means

After GITLAB_REDIRECT_URI parses as a URL, resolveCallbackOptions requires the protocol to be http: or https:. Any other scheme (ftp:, ws:, app:, vscode:, etc.) throws this configuration OAuthError. The local callback server can only speak plain HTTP(S), so other schemes cannot receive the OAuth code.

Source

Thrown at packages/ai/src/registry/oauth/gitlab-duo.ts:69

	if (!raw) {
		return {
			preferredPort: DEFAULT_CALLBACK_PORT,
			callbackPath: DEFAULT_CALLBACK_PATH,
			callbackHostname: DEFAULT_CALLBACK_HOSTNAME,
		};
	}

	let parsed: URL;
	try {
		parsed = new URL(raw);
	} catch {
		throw new AIError.OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {
			kind: "configuration",
			provider: "gitlab-duo",
		});
	}
	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {
			kind: "configuration",
			provider: "gitlab-duo",
		});
	}

	const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
	if (isLoopback && parsed.protocol !== "http:") {
		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {
			kind: "configuration",
			provider: "gitlab-duo",
		});
	}

	const port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;

	return {
		preferredPort: isLoopback ? port : 0,
		callbackPath: parsed.pathname || DEFAULT_CALLBACK_PATH,

View on GitHub (pinned to 9690622007)

Solutions

1. Change GITLAB_REDIRECT_URI to start with http:// (recommended for loopback) or https://.
2. Use http://localhost:<port>/callback and register that exact URI on your GitLab OAuth application.
3. Unset GITLAB_REDIRECT_URI to use the built-in default http://localhost:8080/callback.
4. Use GITLAB_TOKEN (Personal Access Token) to bypass the browser OAuth flow entirely.

Example fix

// before (.env)
GITLAB_REDIRECT_URI=vscode://gitlab.gitlab-workflow/authentication

// after (.env)
GITLAB_REDIRECT_URI=http://localhost:8080/callback

const raw = process.env.GITLAB_REDIRECT_URI?.trim();
if (raw) {
  const u = new URL(raw);
  if (u.protocol !== "http:" && u.protocol !== "https:") {
    throw new Error(`GITLAB_REDIRECT_URI must start with http:// or https://, got: ${raw}`);
  }
}

try {
  await loginGitLabDuo(callbacks);
} catch (err) {
  if (err?.kind === "configuration" && String(err.message).includes("must use http:// or https://")) {
    process.env.GITLAB_REDIRECT_URI = "http://localhost:8080/callback";
    await loginGitLabDuo(callbacks);
  } else {
    throw err;
  }
}

When it happens

Trigger: GITLAB_REDIRECT_URI is a valid URL whose scheme is neither http: nor https: — e.g. 'https//...' typos producing odd schemes, 'ftp://localhost/callback', 'vscode://gitlab.gitlab-workflow/authentication', or 'wss://...'.

Common situations: Copying the vscode:// redirect URI used by the Duo Workflow flow into GITLAB_REDIRECT_URI; using custom URI schemes intended for desktop apps; typos where the scheme is mangled so URL parsing succeeds with an unexpected protocol.

Related errors

• Invalid GITLAB_REDIRECT_URI: ${raw}
• GITLAB_REDIRECT_URI loopback callbacks must use http://, got
• OMP_AUTH_BROKER_URL must be set (or `auth.broker.url` in con
• Azure OpenAI base URL is required. Set AZURE_OPENAI_BASE_URL
• Unknown OAuth provider: ${provider}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/93a0d38584c7ed69. Report an issue: GitHub.