chatboxai/chatbox · error · VibedropAuthError

VibeDrop authorization failed

Error message

VibeDrop authorization failed

What it means

Thrown as VibedropAuthError when the VibeDrop inline-publish endpoint returns HTTP 401 or 403. It indicates the vdKey/bearer is missing, invalid, or expired. The message prefers the server's error.message and falls back to 'VibeDrop authorization failed'.

Source

Thrown at src/renderer/packages/vibedrop.ts:101

    ignoreResponseError: true,
  })
  return { status: response.status, json: response._data ?? null }
}

export async function publishToVibedrop(params: PublishToVibedropParams): Promise<VibedropSite> {
  const { html, vdKey, title, visibility, slug } = params
  if (!html?.trim()) {
    throw new Error('HTML content is empty, nothing to publish.')
  }

  const body: Record<string, unknown> = { html, visibility }
  if (title) body.title = title
  if (slug) body.slug = slug

  const { status, json } = await postJson(`${VIBEDROP_API_ORIGIN}/v1/sites/inline`, body, vdKey)

  if (status === 401 || status === 403) {
    throw new VibedropAuthError(json?.error?.message || 'VibeDrop authorization failed')
  }
  if (status === 404 && json?.error?.code === 'slug_not_owned') {
    throw new VibedropSlugNotOwnedError('slug no longer owned')
  }
  if (status >= 400 || !json?.site?.url) {
    throw new Error(json?.error?.message || `Failed to publish to VibeDrop (status ${status})`)
  }

  return { slug: json.site.slug, url: json.site.url, visibility: json.site.visibility }
}

// ===== client-side caches (settings-persisted) =====

// Decodes the email claim from the current account's JWT access token. Used to
// bind the cached publish key to an account so it is never reused across
// accounts (e.g. after switching login without an explicit logout).
function currentAccountEmail(): string | null {
  const token = authInfoStore.getState().accessToken

View on GitHub (pinned to 81571269ad)

Solutions

1. Re-issue the vdKey by re-running the vibedrop key-issuance flow, then retry.
2. If the account changed, clear the cached key so a fresh one is issued for the current account.
3. Verify the Authorization header is being sent with the correct bearer value.
4. If the server message indicates a specific cause, follow it (e.g. re-login).

function hasVdKey(): boolean {
  return !!getCachedVdKey()
}
if (!hasVdKey()) {
  // run key-issuance flow before publishing
}

function isVibedropAuthError(e: unknown): e is VibedropAuthError {
  return e instanceof VibedropAuthError
}

try {
  await publishToVibedrop(params)
} catch (e) {
  if (e instanceof VibedropAuthError) {
    // clear cached vdKey, re-issue, then retry once
  }
}

When it happens

Trigger: postJson to /v1/sites/inline returns status 401 or 403; the catch `if (status === 401 || status === 403) throw new VibedropAuthError(json?.error?.message || 'VibeDrop authorization failed')` fires.

Common situations: Cached vdKey expired or was revoked; the user switched accounts and the cached key belongs to another account; the key was never issued (see email_required, error 193); clock skew or session invalidation server-side.

Related errors

• Failed to publish to VibeDrop (status ${status})
• Invalid pagination parameters
• email required
• HTML content is empty, nothing to publish.
• slug no longer owned

AI-assisted analysis of chatboxai/chatbox@81571269ad (2026-08-12). Data as JSON: /api/errors/35c423821df134ac. Report an issue: GitHub.