crewAIInc/crewAI · error · ValueError

Invalid JSON response from {oauth_endpoint}

Error message

Invalid JSON response from {oauth_endpoint}

What it means

Raised during enterprise onboarding (`crewai enterprise connect` style flow) when the OAuth2 discovery endpoint returns HTTP 200 but a body that is not valid JSON. The CLI fetches {enterprise_url}/.../oauth config with httpx, calls response.json(), and json.JSONDecodeError is re-raised as ValueError with the offending URL. It indicates the endpoint replied with HTML/plain text instead of a JSON document.

Source

Thrown at lib/cli/src/crewai_cli/enterprise/main.py:56

            raise SystemExit(1) from e

    def _fetch_oauth_config(self, enterprise_url: str) -> dict[str, Any]:
        oauth_endpoint = f"{enterprise_url}/auth/parameters"

        try:
            console.print(f"🔄 Fetching OAuth2 configuration from {oauth_endpoint}...")
            headers = {
                "Content-Type": "application/json",
                "User-Agent": f"CrewAI-CLI/{get_crewai_version()}",
                "X-Crewai-Version": get_crewai_version(),
            }
            response = httpx.get(oauth_endpoint, timeout=30, headers=headers)
            response.raise_for_status()

            try:
                oauth_config = response.json()
            except json.JSONDecodeError as e:
                raise ValueError(f"Invalid JSON response from {oauth_endpoint}") from e

            self._validate_oauth_config(oauth_config)

            console.print(
                "✅ Successfully retrieved OAuth2 configuration", style="green"
            )
            return cast(dict[str, Any], oauth_config)

        except httpx.HTTPError as e:
            raise ValueError(f"Failed to connect to enterprise URL: {e!s}") from e
        except Exception as e:
            raise ValueError(f"Error fetching OAuth2 configuration: {e!s}") from e

    def _update_oauth_settings(
        self, enterprise_url: str, oauth_config: dict[str, Any]
    ) -> None:
        try:
            config_mapping = {

View on GitHub (pinned to 754d7323be)

Solutions

1. curl the oauth_endpoint URL directly (e.g. curl -H 'Accept: application/json' <url>) and confirm it returns JSON
2. Fix the enterprise base URL: correct scheme, host, port, and no duplicated path segments
3. If a proxy/WAF is involved, allowlist the CLI's User-Agent (CrewAI-CLI/<version>) or bypass the proxy for that host
4. Check the enterprise server logs to confirm the OAuth discovery route is enabled and healthy

Example fix

# before
crewai enterprise connect https://acme.internal/auth/auth
# after (base URL only; CLI derives the discovery path)
crewai enterprise connect https://acme.internal

import httpx, json

def discovery_returns_json(url: str) -> bool:
    r = httpx.get(url, timeout=30, headers={"Accept": "application/json"})
    r.raise_for_status()
    try:
        return isinstance(r.json(), dict)
    except json.JSONDecodeError:
        return False

def is_oauth_config(value: object) -> bool:
    required = {"audience", "domain", "provider", "device_authorization_client_id", "extra"}
    return isinstance(value, dict) and required.issubset(value)

try:
    enterprise_cmd.connect(url)
except ValueError as e:
    if str(e).startswith("Invalid JSON response"):
        # endpoint served non-JSON; inspect with curl, fix URL/proxy
        ...

When it happens

Trigger: Passing an enterprise URL that serves an HTML login page or proxy error page at the OAuth discovery path; a reverse proxy or captive portal intercepting the request; a wrong scheme/port so a different service answers; trailing-slash or path mistakes making the constructed oauth_endpoint point at a non-API route.

Common situations: Corporate proxies that rewrite responses, misconfigured enterprise base URL (e.g. including /auth twice, or http vs https), CDN/WAF challenge pages (Cloudflare interstitials), or the enterprise server being upgraded and temporarily serving maintenance HTML.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Failed to connect to enterprise URL: {e!s}
• Error fetching OAuth2 configuration: {e!s}
• Failed to update OAuth2 settings: {e!s}
• Missing required fields in OAuth2 configuration: [{', '.join
• Missing authentication provider required fields in OAuth2 co

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/ef8fbc8be227b8a6. Report an issue: GitHub.