decolua/9router · error · Error

${callbackParams.error_description || callbackParams.error}

Error message

${callbackParams.error_description || callbackParams.error}

What it means

Thrown by AntigravityService.connect when the OAuth provider redirected back to the local callback server with an `error` query parameter instead of an authorization `code`. The message prefers the OAuth-standard `error_description` and falls back to the bare `error` code (e.g. access_denied). This means Google explicitly refused or aborted the authorization.

Source

Thrown at src/lib/oauth/services/antigravity.js:274

      await new Promise((resolve, reject) => {
        const timeout = setTimeout(() => {
          reject(new Error("Authentication timeout (5 minutes)"));
        }, 300000);

        const checkInterval = setInterval(() => {
          if (callbackParams) {
            clearInterval(checkInterval);
            clearTimeout(timeout);
            resolve();
          }
        }, 100);
      });

      close();

      if (callbackParams.error) {
        throw new Error(callbackParams.error_description || callbackParams.error);
      }

      if (!callbackParams.code) {
        throw new Error("No authorization code received");
      }

      spinner.start("Exchanging code for tokens...");

      // Exchange code for tokens
      const tokens = await this.exchangeCode(callbackParams.code, redirectUri);

      spinner.text = "Fetching user info...";

      // Get user info
      const userInfo = await this.getUserInfo(tokens.access_token);

      spinner.text = "Loading Code Assist configuration...";

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Read error_description in the message to see Google's exact refusal reason
2. If access_denied: allow the app under Google Account → Security → Third-party access, or have a Workspace admin whitelist it
3. If redirect_uri_mismatch: add the exact localhost callback URL shown in the CLI to the OAuth client's authorized redirect URIs in Google Cloud Console
4. Just re-run connect and complete the consent screen without cancelling

// before opening the browser, verify the OAuth client config
if (!CLIENT_ID) throw new Error('Missing OAuth client_id — check antigravity config');
console.log('If the browser shows an error, note error_description before closing the tab');

function isOAuthError(params) { return params != null && typeof params.error === 'string' && params.error.length > 0; }

try {
  await service.connect();
} catch (e) {
  if (e.message === 'access_denied') {
    console.error('Consent denied. Allow the app in Google Account → Security → Third-party access.');
  } else if (e.message.includes('redirect_uri_mismatch')) {
    console.error('Add the CLI callback URL to authorized redirect URIs in Google Cloud Console.');
  } else throw e;
}

When it happens

Trigger: User clicks 'Cancel'/'Deny' on the Google consent screen; Google redirects with error=access_denied (scopes rejected or admin policy); redirect_uri mismatch produces error=redirect_uri_mismatch; invalid/expired request produces error=invalid_request.

Common situations: Workspace admins blocking third-party app access (Google Workspace 'unconfigured app' block); user closing the consent tab after Google already redirected with an error; client_id's authorized redirect URIs changed in Google Cloud Console.

Related errors

• Vertex: failed to mint access token from Service Account JSO
• Vertex: failed to refresh access token from ADC JSON (author
• loadCodeAssist failed: HTTP ${response.status} ${errorText.s
• onboardUser HTTP ${response.status}: ${errorText.slice(0, 20
• Failed to onboard user: ${errorText}

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/4993e33c771b3258. Report an issue: GitHub.