decolua/9router · error

${callbackParams.error_description || callbackParams.error}

Error message

${callbackParams.error_description || callbackParams.error}

What it means

During the browser-based OAuth flow, startAuthFlow spins up a local HTTP server and the provider redirects back to it. If the redirect URL contains an `error` query parameter (standard OAuth2 error response: access_denied, invalid_scope, etc.), waitForCallback throws an Error whose message is the `error_description` if present, otherwise the `error` code itself. This surfaces the provider-side refusal of authorization instead of letting the flow continue with no code.

Source

Thrown at src/lib/oauth/services/oauth.js:72

        await new Promise((resolve, reject) => {
          const timeout = setTimeout(() => {
            reject(new Error("Authentication timeout (5 minutes)"));
          }, OAUTH_TIMEOUT);

          const checkInterval = setInterval(() => {
            if (callbackParams) {
              clearInterval(checkInterval);
              clearTimeout(timeout);
              resolve();
            }
          }, 100);
        });

        spinner.stop();
        close();

        if (callbackParams.error) {
          throw new Error(callbackParams.error_description || callbackParams.error);
        }

        if (!callbackParams.code) {
          throw new Error("No authorization code received");
        }

        return callbackParams;
      },
    };
  }

  /**
   * Exchange authorization code for tokens
   */
  async exchangeCode(code, redirectUri, codeVerifier, contentType = "application/x-www-form-urlencoded") {
    const body =
      contentType === "application/json"
        ? JSON.stringify({

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Retry the flow and click 'Allow'/approve on the provider's consent screen.
2. Read the thrown message: OAuth codes like access_denied or invalid_scope indicate a scope/client configuration problem — fix the requested scopes or client settings.
3. Verify the app's client_id / redirect_uri registration with the provider matches what startAuthFlow generates.
4. Ensure the authorizing account has the required provider entitlements (e.g. active subscription).

Example fix

// before
const params = await flow.waitForCallback(); // throws 'access_denied'
// after
try {
  const params = await flow.waitForCallback();
} catch (e) {
  if (e.message.includes("access_denied")) {
    console.error("Authorization was denied — approve the consent prompt and retry");
  }
  throw e;
}

// Nothing to check before the call — the error originates from the provider redirect.
// Pre-flight you CAN do: verify client_id/redirect_uri/scopes are registered with the provider
// so the provider does not bounce with an error parameter.

function isOAuthErrorParams(params) {
  return params != null && typeof params.error === "string" && params.error.length > 0;
}

try {
  const params = await flow.waitForCallback();
  // proceed with params.code
} catch (e) {
  if (/access_denied/i.test(e.message)) {
    console.error("User denied authorization — retry and approve the consent prompt");
  } else if (/invalid_scope/i.test(e.message)) {
    console.error("Requested scopes not allowed — adjust requested scopes");
  } else {
    throw e;
  }
}

When it happens

Trigger: Calling the returned waitForCallback() when the provider redirects to http://localhost:<port>/callback?error=... (optionally with error_description) — i.e. the user or provider denied authorization on the consent screen.

Common situations: User clicked 'Cancel'/'Deny' on the provider consent page (access_denied); the app's requested scopes are not approved for the client (invalid_scope); the provider account lacks the required entitlement; redirect_uri/client_id misconfiguration causing the provider to bounce the request with an error parameter.

Related errors

• ${params.error_description || params.error}
• No authorization code received
• ${callbackParams.error_description || callbackParams.error}
• No authorization code received
• ${callbackParams.error_description || callbackParams.error}

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/2f70c6d5ae3bedc0. Report an issue: GitHub.