can1357/oh-my-pi · error · AIError.OAuthError

Token response missing required fields

Error message

Token response missing required fields

What it means

Thrown when OpenAI's token endpoint returned 200 but the parsed JSON lacks the fields the Codex flow requires: access_token, refresh_token, or a numeric expires_in. The library treats a structurally incomplete success response as a validation failure rather than handing back unusable credentials. Classified kind='validation'.

Source

Thrown at packages/ai/src/registry/oauth/openai-codex.ts:207

	});

	if (!tokenResponse.ok) {
		const bodyText = await tokenResponse.text();
		throw new AIError.OAuthError(
			`Token exchange failed: ${formatOpenAICodexTokenEndpointError(tokenResponse.status, bodyText)}`,
			{ kind: "token-exchange", status: tokenResponse.status },
		);
	}

	const tokenData = (await tokenResponse.json()) as {
		access_token?: string;
		refresh_token?: string;
		id_token?: string;
		expires_in?: number;
	};

	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") {
		throw new AIError.OAuthError("Token response missing required fields", { kind: "validation" });
	}

	const { accountId, email, planType } = getTokenProfile(tokenData.access_token, tokenData.id_token);
	if (!accountId) {
		throw new AIError.OAuthError("Failed to extract accountId from token", { kind: "validation" });
	}

	return {
		access: tokenData.access_token,
		refresh: tokenData.refresh_token,
		expires: Date.now() + tokenData.expires_in * 1000,
		accountId,
		email,
		orgId: accountId,
		orgName: planType,
	};
}

View on GitHub (pinned to 9690622007)

Solutions

1. Update the CLI to match the current OpenAI token response contract
2. Log/capture the raw token response body (if your tooling allows) to see what actually came back
3. Check for proxies or VPNs rewriting responses and bypass them
4. Retry the login; if consistently reproducible, report with the redacted response shape

Example fix

null

// can't inspect the response before the call, but validate your environment
// ensure no proxy returns 200 error pages:
// curl -s -o /dev/null -w '%{http_code} %{content_type}' https://auth.openai.com/oauth/token

function isWellFormedTokenResponse(d: unknown): d is { access_token: string; refresh_token: string; expires_in: number } {
  const t = d as Record<string, unknown> | null;
  return !!t && typeof t.access_token === 'string' && typeof t.refresh_token === 'string' && typeof t.expires_in === 'number';
}

try {
  const tokens = await exchangeCodeForToken(code, verifier);
} catch (e) {
  if (e instanceof AIError.OAuthError && e.kind === 'validation' && e.message === 'Token response missing required fields') {
    // log raw response via network tooling; update CLI; retry login
  } else throw e;
}

When it happens

Trigger: The token endpoint responds with a JSON body that is an error object but with HTTP 200, or omits refresh_token (e.g. response for a grant type that doesn't issue refresh tokens), or expires_in is missing/non-numeric; response body is HTML/JSON that doesn't match the expected token shape.

Common situations: OpenAI changing token response shape vs an outdated CLI; API gateway/intermediary returning 200 with an error page; headless environments where a captive portal returns 200 HTML; the endpoint returning {error: ...} with a 200 status.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Device authorization response missing required fields
• Credential ${id} is not OAuth (provider=${provider}, type=${
• GitLab OAuth token response missing required fields
• Token exchange failed: ${formatOpenAICodexTokenEndpointError
• Failed to extract accountId from token

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/96d36fb416fd2d6a. Report an issue: GitHub.