What causes "%s: fetch tenant access token: %w" in chenhg5/cc-connect?

Check outbound connectivity to the Feishu auth endpoint from the host.

%s: fetch tenant access token: %w

Error message

%s: fetch tenant access token: %w

What it means

Wraps a transport-level failure from the SDK's GetTenantAccessTokenBySelfBuiltApp call used to fetch a fresh tenant_access_token. The token request never completed — network, DNS, TLS, or SDK-level error — so no fresh token is available for the retry.

Source

Thrown at platform/feishu/feishu.go:4109

		return err
	}

	freshToken, refreshErr := p.fetchFreshTenantAccessToken(ctx)
	if refreshErr != nil {
		return fmt.Errorf("%s: %s failed after token refresh attempt: %w (original error: %v)", p.tag(), operation, refreshErr, err)
	}

	slog.Warn(p.tag()+": retrying request with fresh tenant access token", "operation", operation)
	return fn(p.replayAPIClient(), larkcore.WithTenantAccessToken(freshToken))
}

func (p *Platform) fetchFreshTenantAccessToken(ctx context.Context) (string, error) {
	resp, err := p.replayAPIClient().GetTenantAccessTokenBySelfBuiltApp(ctx, &larkcore.SelfBuiltTenantAccessTokenReq{
		AppID:     p.appID,
		AppSecret: p.appSecret,
	})
	if err != nil {
		return "", fmt.Errorf("%s: fetch tenant access token: %w", p.tag(), err)
	}
	if !resp.Success() {
		return "", fmt.Errorf("%s: fetch tenant access token code=%d msg=%s", p.tag(), resp.Code, resp.Msg)
	}
	if strings.TrimSpace(resp.TenantAccessToken) == "" {
		return "", fmt.Errorf("%s: fetch tenant access token returned empty token", p.tag())
	}
	return resp.TenantAccessToken, nil
}

func (p *Platform) replayAPIClient() *lark.Client {
	p.replayClientMu.Lock()
	defer p.replayClientMu.Unlock()
	if p.replayClient == nil {
		p.replayClient = newFeishuReplayClient(p.appID, p.appSecret, p.domain)
	}
	return p.replayClient
}

View on GitHub (pinned to 4000b2338a)

Solutions

Check outbound connectivity to the Feishu auth endpoint from the host.
Verify app_id/app_secret are non-empty and correctly set in config.toml.
Retry — transient auth-endpoint failures usually resolve; ensure the outer transient retry covers this path.
Inspect the wrapped error for TLS/DNS specifics to pinpoint the network layer at fault.

Defensive patterns

Strategy: retry

Validate before calling

if p.appID == "" || p.appSecret == "" {
	return errors.New("feishu app_id/app_secret not configured")
}

Try / catch

token, err := p.fetchFreshTenantAccessToken(ctx)
if err != nil {
	if isNetworkError(errors.Unwrap(err)) {
		// retry with backoff; auth endpoint may be temporarily down
	}
	return err
}

Prevention

Check config values at startup and fail fast on empty credentials.
Monitor connectivity to the Feishu auth domain separately from the API domain.
Bound token-refresh retries to avoid cascading load.
Log the unwrapped cause for every token fetch failure.

When it happens

Trigger: p.replayAPIClient().GetTenantAccessTokenBySelfBuiltApp returns err != nil during the token-refresh retry path, typically after an API call failed with an invalid-token error.

Common situations: Feishu auth endpoint outage, host offline, proxy blocking the auth domain, or a malformed appID/appSecret causing an SDK-level error before the request is sent.

Related errors

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/5e24ba78274bf457. Report an issue: GitHub.