What causes "get access token: %w" in chenhg5/cc-connect?

Verify client_id/client_secret are the correct, currently valid AppKey/AppSecret for your DingTalk app.

get access token: %w

Error message

get access token: %w

What it means

getDownloadURL wraps failures from getAccessToken. Before calling the messageFiles/download API, the platform must fetch an OAuth access token; this error means token acquisition failed (bad credentials, network, or token API error).

Source

Thrown at platform/dingtalk/dingtalk.go:677

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, "", fmt.Errorf("read response: %w", err)
	}

	// Determine MIME type from Content-Type header
	mimeType := resp.Header.Get("Content-Type")
	if mimeType == "" {
		mimeType = "audio/amr" // Default to AMR if not specified
	}

	return data, mimeType, nil
}

func (p *Platform) getDownloadURL(downloadCode string) (string, error) {
	token, err := p.getAccessToken()
	if err != nil {
		return "", fmt.Errorf("get access token: %w", err)
	}

	reqBody := map[string]string{
		"downloadCode": downloadCode,
		"robotCode":    p.robotCode,
	}
	bodyBytes, err := json.Marshal(reqBody)
	if err != nil {
		return "", fmt.Errorf("marshal request: %w", err)
	}

	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
		"https://api.dingtalk.com/v1.0/robot/messageFiles/download",
		bytes.NewReader(bodyBytes))
	if err != nil {
		return "", fmt.Errorf("create request: %w", err)

View on GitHub (pinned to 4000b2338a)

Solutions

Verify client_id/client_secret are the correct, currently valid AppKey/AppSecret for your DingTalk app.
Check the wrapped cause: 4xx indicates bad credentials, network errors indicate connectivity.
Confirm the app is enabled and has the robot/media download permissions granted in the DingTalk developer console.
If rate-limited, back off and cache the token until near expiry.

Defensive patterns

Strategy: validation

Validate before calling

func validateDingtalkCredentials(clientID, clientSecret string) error {
    req, _ := http.NewRequest(http.MethodPost, "https://api.dingtalk.com/v1.0/oauth2/accessToken",
        strings.NewReader(fmt.Sprintf(`{"appKey":%q,"appSecret":%q}`, clientID, clientSecret)))
    req.Header.Set("Content-Type", "application/json")
    resp, err := http.DefaultClient.Do(req)
    if err != nil { return err }
    defer resp.Body.Close()
    if resp.StatusCode != http.StatusOK {
        b, _ := io.ReadAll(resp.Body)
        return fmt.Errorf("token check failed: %d %s", resp.StatusCode, b)
    }
    return nil
}

Try / catch

if err != nil && strings.Contains(err.Error(), "get access token") {
    // credentials/auth problem: alert ops, do not retry blindly
    log.Error("dingtalk auth misconfigured", "err", err)
}

Prevention

Validate AppKey/AppSecret once at startup with a token probe
Rotate secrets via config reload, not in-place edits
Cache tokens until near expiry to avoid rate limits

When it happens

Trigger: Called from handleImageMessage, handleFileMessage, or downloadAudio when p.getAccessToken() returned an error — typically invalid client_id/client_secret or a failed call to the DingTalk token endpoint.

Common situations: Wrong or rotated AppKey/AppSecret; DingTalk app disabled or permissions revoked; no outbound access to DingTalk auth endpoint; token endpoint rate limiting after aggressive polling.

Related errors

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/8a224a684e5d14e0. Report an issue: GitHub.