decolua/9router · error

CLIProxyAPI auth JSON is required

Error message

CLIProxyAPI auth JSON is required

What it means

After optional JSON parsing, normalizeKiroExternalIdpAuth requires the input to be a non-null object. Null, arrays of nothing meaningful, numbers, booleans, or JSON strings like '"token"' or 'null' reach this guard and throw. It signals the auth value was parseable but not the expected object-shaped auth document.

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:88

  if (payload?.exp) {
    return new Date(payload.exp * 1000).toISOString();
  }

  return new Date(Date.now() + DEFAULT_EXPIRES_IN * 1000).toISOString();
}

export function normalizeKiroExternalIdpAuth(rawAuth) {
  let input = rawAuth;
  if (typeof input === "string") {
    try {
      input = JSON.parse(input);
    } catch {
      throw new Error("CLIProxyAPI auth JSON is invalid");
    }
  }

  if (!input || typeof input !== "object") {
    throw new Error("CLIProxyAPI auth JSON is required");
  }

  const authMethod = normalizeString(input.auth_method || input.authMethod);
  if (authMethod && authMethod !== "external_idp") {
    throw new Error("Only external_idp Kiro auth is supported by this importer");
  }

  const accessToken = normalizeString(input.access_token || input.accessToken);
  const refreshToken = normalizeString(input.refresh_token || input.refreshToken);
  const clientId = normalizeString(input.client_id || input.clientId);
  const tokenEndpoint = validateMicrosoftTokenEndpoint(input.token_endpoint || input.tokenEndpoint);
  const profileArn = normalizeString(input.profile_arn || input.profileArn);
  const region = normalizeString(input.region) || DEFAULT_REGION;
  const scope = normalizeScope(input.scopes || input.scope);

  if (!accessToken) throw new Error("access_token is required");
  if (!refreshToken) throw new Error("refresh_token is required");
  if (!clientId) throw new Error("client_id is required");

View on GitHub (pinned to 90b52e06ff)

Solutions

  1. Pass the full CLIProxyAPI auth object containing access_token, refresh_token, client_id, token_endpoint, scopes, profile_arn
  2. Check the source file: if it holds only a token, export the complete auth JSON instead
  3. Add a typeof check before calling to fail with a clearer local message
  4. If the value may be absent, guard the call site and skip import rather than passing null

Example fix

// before
normalizeKiroExternalIdpAuth(null)
// after
if (!auth || typeof auth !== 'object' || Array.isArray(auth)) {
  throw new Error('Kiro auth file must contain a JSON object');
}
normalizeKiroExternalIdpAuth(auth);
Defensive patterns

Strategy: type-guard

Validate before calling

if (auth == null || typeof auth !== 'object' || Array.isArray(auth)) {
  throw new Error('Kiro auth must be a JSON object');
}

Type guard

function isAuthObject(v) {
  return v !== null && typeof v === 'object' && !Array.isArray(v);
}

Try / catch

try {
  normalizeKiroExternalIdpAuth(maybeAuth);
} catch (e) {
  if (e.message === 'CLIProxyAPI auth JSON is required') {
    console.error('Auth value parsed to a non-object; check the file contents');
  }
  throw e;
}

Prevention

When it happens

Trigger: Passing null/undefined, a JSON string that parses to a non-object (e.g. '"abc"', '123', 'null'), or an array to normalizeKiroExternalIdpAuth.

Common situations: A config field left empty and trimmed to empty/"null" text; the auth JSON file containing just a token value; a caller passing an access-token string directly instead of the full auth record.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/1f98ba525dca62bb. Report an issue: GitHub.