OpenAI token ${operation} request failed: ${error instanceof

Error message

OpenAI token ${operation} request failed: ${error instanceof Error ? error.message : String(error)}

What it means

postTokenRequest (openai-oauth.ts:180) wraps any fetch rejection that is neither caller-abort nor TimeoutError into 'OpenAI token <operation> request failed: <cause>'. This is the catch-all for transport-level failures reaching OpenAI's token endpoint: DNS failure, connection refused/reset, TLS errors, etc. The original cause's message is preserved inline.

Source

Thrown at packages/core/src/credentials/openai-oauth.ts:180

    response = await fetch(OPENAI_TOKEN_URL, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body,
      // The 30s ceiling applies ALWAYS — combined with the caller's session
      // signal when present. Without it, a hung token endpoint would leave a
      // bridge login reporting `pending` for the session's full 10-minute TTL.
      signal: signal
        ? AbortSignal.any([signal, AbortSignal.timeout(30_000)])
        : AbortSignal.timeout(30_000),
    });
  } catch (error) {
    if (signal?.aborted) {
      throw new Error('Login cancelled');
    }
    if (error instanceof Error && error.name === 'TimeoutError') {
      throw new Error(`OpenAI token ${operation} request timed out.`);
    }
    throw new Error(
      `OpenAI token ${operation} request failed: ${error instanceof Error ? error.message : String(error)}`
    );
  }
  if (!response.ok) {
    // Strip the error body down to the OAuth `error` code: this message flows
    // into the bridge's session.detail (and on to the browser/CLI), and OpenAI
    // error bodies can carry account identifiers. Never include the raw body.
    const text = await response.text().catch(() => '');
    let errorCode = '';
    try {
      const parsed = JSON.parse(text) as { error?: unknown };
      if (typeof parsed.error === 'string') {
        errorCode = parsed.error;
      } else if (parsed.error && typeof parsed.error === 'object') {
        const code = (parsed.error as { code?: unknown }).code;
        if (typeof code === 'string') errorCode = code;
      }
    } catch {

View on GitHub (pinned to 0773b97458)

Solutions

Read the embedded cause message to identify the transport fault (DNS vs refused vs TLS).
Verify outbound HTTPS connectivity to the OpenAI token endpoint from the Archon host.
Fix proxy env vars (HTTPS_PROXY) or install the corporate CA so TLS interception validates.
Retry — transient connection resets resolve on the next attempt or refresh cycle.

Defensive patterns

Strategy: retry

Validate before calling

// Pre-flight DNS/TLS check to the token endpoint host
dns.promises.lookup('auth.openai.com').catch(() => {
  throw new Error('DNS cannot resolve auth.openai.com; fix connectivity first.');
});

Try / catch

try {
  await refreshToken(token);
} catch (e) {
  const m = e instanceof Error ? e.message : '';
  if (m.startsWith('OpenAI token refresh request failed:')) {
    // Transport-level fault: inspect cause (ENOTFOUND/ECONNRESET/TLS) before retry
    getLog().warn({ cause: m }, 'openai_token_transport_failure');
    return retryWithBackoff(() => refreshToken(token));
  }
  throw e;
}

Prevention

Install corporate CA certificates so TLS interception validates.
Verify HTTPS_PROXY/NO_PROXY env vars point at a working egress proxy.
Monitor host DNS and outbound firewall rules.
Distinguish transport failures (retry) from HTTP rejections (don't blindly retry).

When it happens

Trigger: fetch to OPENAI_TOKEN_URL throws for reasons other than caller abort or 30s timeout — connection refused, ENOTFOUND (DNS), ECONNRESET, TLS certificate errors, offline interfaces, or invalid proxy configuration.

Common situations: No internet access or DNS misconfiguration on the host; corporate proxy with TLS interception presenting an untrusted certificate; firewall blocking egress; transient network flap during login or refresh.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/75adfd2b9c545dc7. Report an issue: GitHub.