chenhg5/cc-connect · error

code=%d msg=%s

Error message

code=%d msg=%s

What it means

After decoding the tenant_token response, if code != 0 or the token is empty, the API's own error is surfaced as `code=<code> msg=<msg>` when msg is non-empty. This is the Feishu/Lark API's own rejection of the credential, passed through verbatim.

Source

Thrown at cmd/cc-connect/feishu.go:529

	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	data, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	if err != nil {
		return false, err
	}

	var parsed tenantTokenResponse
	if err := json.Unmarshal(data, &parsed); err != nil {
		return false, fmt.Errorf("decode response: %w", err)
	}
	if parsed.Code == 0 && parsed.TenantAccessToken != "" {
		return true, nil
	}
	if parsed.Msg != "" {
		return false, fmt.Errorf("code=%d msg=%s", parsed.Code, parsed.Msg)
	}
	return false, nil
}

func runRegistrationFlow(opts registrationFlowOptions) (*registrationFlowResult, error) {
	if opts.TimeoutSeconds <= 0 {
		opts.TimeoutSeconds = 600
	}
	client := &registrationClient{
		baseURL: accountsFeishuBaseURL,
		http:    &http.Client{Timeout: 15 * time.Second},
		debug:   opts.Debug,
	}

	var initRes registrationInitResponse
	if err := client.registrationCall("init", nil, &initRes); err != nil {
		return nil, fmt.Errorf("init failed: %w", err)
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Look up the numeric code in Feishu/Lark open-platform docs and fix per the msg.
2. Re-copy app_id/app_secret from the console; secrets are shown only once at creation.
3. Confirm the app is enabled and belongs to the tenant matching the base URL (feishu vs lark).
4. If the secret was rotated, use the new value in --app.

Example fix

// before
cc-connect feishu setup --app cli_wrongid:old_secret
// after
cc-connect feishu setup --app "cli_a1b2c3:new_secret"

var apiErr struct{ Code int `json:"code"`; Msg string `json:"msg"` }
if _, err := validateAppCredentials(...); err != nil {
    if code, msg, ok := parseCodeMsg(err.Error()); ok { // matches code=%d msg=%s
        handleFeishuAPIError(code, msg) // look up code in Feishu docs
    }
}

When it happens

Trigger: The tenant_access_token endpoint responds with a non-zero business code (e.g. invalid app_id, invalid app_secret, app not enabled) together with a human-readable msg.

Common situations: Wrong secret after rotation; using a Lark app against the Feishu endpoint; app disabled or deleted; insufficient app permissions for token issuance.

Related errors

• remote returned non-zero code
• app_id/app_secret are required
• both --app-id and --app-secret are required
• bind mode requires credentials: use --app id:secret or --app
• %s: %s

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/b1147c030cdfa73c. Report an issue: GitHub.