chenhg5/cc-connect · error

authorization denied by user

Error message

authorization denied by user

What it means

The user explicitly denied the authorization request during QR onboarding: the poll response carried error=access_denied. This is a deliberate user action (declining the bot creation/authorization in the Feishu/Lark app), so the flow stops immediately instead of continuing to poll.

Source

Thrown at cmd/cc-connect/feishu.go:629

				continue
			}
		}

		if pollRes.ClientID != "" && pollRes.ClientSecret != "" {
			return &registrationFlowResult{
				AppID:       pollRes.ClientID,
				AppSecret:   pollRes.ClientSecret,
				OwnerOpenID: pollRes.UserInfo.OpenID,
				Platform:    platformType,
			}, nil
		}

		switch pollRes.Error {
		case "", "authorization_pending":
		case "slow_down":
			interval += 5
		case "access_denied":
			return nil, fmt.Errorf("authorization denied by user")
		case "expired_token":
			return nil, fmt.Errorf("onboarding session expired")
		default:
			if pollRes.Error != "" {
				return nil, fmt.Errorf("%s: %s", pollRes.Error, pollRes.ErrorDescription)
			}
		}

		time.Sleep(time.Duration(interval) * time.Second)
	}

	return nil, fmt.Errorf("timed out waiting for QR onboarding result")
}

func (c *registrationClient) registrationCall(action string, params map[string]string, out any) error {
	form := url.Values{}
	form.Set("action", action)
	for k, v := range params {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Re-run the setup command to generate a fresh QR code and approve the authorization this time.
2. Ensure the person scanning is the intended account owner with rights to create/authorize the bot.
3. Read any tenant policy restrictions first — if the tenant blocks personal-agent creation, approval will keep being denied.
4. If denial was accidental, no state needs cleanup; a new device-code session is issued on each setup run.

Example fix

// before
// user taps 'Deny' in Feishu app → authorization denied by user
// after
$ cc-connect setup feishu   # rescan QR and tap 'Allow'

if err := runRegistrationFlow(...); err != nil {
	if strings.Contains(err.Error(), "authorization denied by user") {
		fmt.Println("Authorization was denied. Re-run setup and tap Allow in the Feishu app.")
		return nil // user-actionable, not a system fault
	}
	return err
}

When it happens

Trigger: During the poll loop the server returns pollRes.Error == "access_denied", i.e. the user scanned the QR code and tapped 'deny' on the consent screen.

Common situations: User scanning the QR but rejecting the permission request; an admin or the wrong person scanning and denying; accidental tap on the mobile app consent dialog.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• current environment does not support client_secret auth
• onboarding session expired
• timed out waiting for QR onboarding result
• app_id/app_secret are required
• invalid remote image URL

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/5a1bb94c40d202be. Report an issue: GitHub.