chatboxai/chatbox · error · Error

No authorization code found in the input

Error message

No authorization code found in the input

What it means

Thrown by Anthropic's CodePaste OAuth provider inside exchangeCode() after parseCallbackInput() fails to extract an authorization code from the user-pasted input. Because the parser falls back to treating the trimmed input as a bare code, this branch is only reachable when the input is empty or pure whitespace, meaning the user submitted nothing or only the state/whitespace where a code was expected.

Source

Thrown at src/main/oauth/providers/anthropic.ts:99

      state: verifier,
    })

    const authUrl = `${AUTHORIZE_URL}?${authParams.toString()}`
    return { authUrl }
  },

  async exchangeCode(authInput: string) {
    if (!pendingVerifier) {
      throw new Error('No pending login flow. Call startLogin first.')
    }

    const verifier = pendingVerifier
    pendingVerifier = null

    const { code, state } = parseCallbackInput(authInput)

    if (!code) {
      throw new Error('No authorization code found in the input')
    }

    const response = await fetch(TOKEN_URL, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        grant_type: 'authorization_code',
        client_id: CLIENT_ID,
        code,
        // Preserve the verifier-backed state on exchange as well, otherwise Anthropic rejects
        // the flow even though this differs from a more typical OAuth implementation.
        state: state || verifier,
        redirect_uri: REDIRECT_URI,
        code_verifier: verifier,
      }),
    })

    if (!response.ok) {

View on GitHub (pinned to 81571269ad)

Solutions

1. Validate that authInput.trim() is non-empty and looks like a URL, query string, or code before calling exchangeCode().
2. Show a clearer UI hint: 'Paste the full callback URL from the browser (it contains ?code=...)' so the user knows what to supply.
3. If parsing succeeds but code is missing, surface a specific message telling the user the pasted text had no code parameter rather than a generic error.

Example fix

// before
await provider.exchangeCode(authInput)

// after
const trimmed = authInput.trim()
if (!trimmed) throw new Error('Paste the full callback URL or authorization code first.')
if (!trimmed.includes('code=') && !trimmed.includes('#') && trimmed.length < 16) {
  throw new Error('Input does not look like an authorization code or callback URL.')
}
await provider.exchangeCode(trimmed)

function isValidCodeInput(authInput: unknown): authInput is string {
  return typeof authInput === 'string' && authInput.trim().length > 0
}

// before calling exchangeCode:
if (!isValidCodeInput(authInput)) {
  throw new Error('Paste the full callback URL or authorization code first.')
}
await provider.exchangeCode(authInput)

function looksLikeCallbackOrCode(input: string): boolean {
  const t = input.trim()
  if (!t) return false
  return t.includes('code=') || t.includes('#') || t.length >= 16
}

try {
  await provider.exchangeCode(authInput)
} catch (e) {
  if (/No authorization code/i.test(String(e))) {
  // user input issue — re-prompt, do not retry with same value
  }
  throw e
}

When it happens

Trigger: Calling anthropicOAuthProvider.exchangeCode(''), exchangeCode(' '), or pasting only a fragment that contains no 'code=' parameter and no bare-code text (e.g. only '?state=xxx'). It also fires if startLogin was called but the user closed the browser and submitted an empty string.

Common situations: User clicks 'submit' on the paste dialog without pasting anything; user pastes only the redirect state; clipboard copy failed so the field is blank; automated test passes an empty string to exchangeCode().

Related errors

• No refresh token available
• Token exchange failed: ${error}
• Token refresh failed: ${error}
• No refresh token available
• Token refresh response missing access_token

AI-assisted analysis of chatboxai/chatbox@81571269ad (2026-08-12). Data as JSON: /api/errors/13d73298a5734dc2. Report an issue: GitHub.