decolua/9router · error

Failed to register client: ${error}

Error message

Failed to register client: ${error}

What it means

Thrown by KiroService.registerClient when the AWS SSO OIDC endpoint (https://oidc.<region>.amazonaws.com/client/register) responds with a non-2xx status. The raw response body is interpolated into the message, so it typically contains AWS's JSON error such as invalidRequest or accessDenied. Without a registered client there is no clientId/clientSecret, so the device-code flow cannot start.

Source

Thrown at src/lib/oauth/services/kiro.js:39

    const endpoint = `https://oidc.${region}.amazonaws.com/client/register`;

    const response = await fetch(endpoint, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        clientName: KIRO_CONFIG.clientName,
        clientType: KIRO_CONFIG.clientType,
        scopes: KIRO_CONFIG.scopes,
        grantTypes: KIRO_CONFIG.grantTypes,
        issuerUrl: KIRO_CONFIG.issuerUrl,
      }),
    });

    if (!response.ok) {
      const error = await response.text();
      throw new Error(`Failed to register client: ${error}`);
    }

    const data = await response.json();
    return {
      clientId: data.clientId,
      clientSecret: data.clientSecret,
      clientSecretExpiresAt: data.clientSecretExpiresAt,
    };
  }

  /**
   * Start device authorization for AWS Builder ID or IDC
   */
  async startDeviceAuthorization(clientId, clientSecret, startUrl, region = "us-east-1") {
    assertValidAwsRegion(region);
    const endpoint = `https://oidc.${region}.amazonaws.com/device_authorization`;

    const response = await fetch(endpoint, {

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Read the interpolated response body in the message — AWS returns a JSON error code naming the exact problem.
2. Verify the region argument is a valid AWS SSO OIDC region (the code validates it via assertValidAwsRegion before the call).
3. Retry after a short backoff if the body indicates throttling (429 / SlowDown).
4. Confirm outbound HTTPS to oidc.<region>.amazonaws.com is not blocked by proxy/firewall.

Example fix

// before: unknown region string
const svc = new KiroService();
await svc.registerClient("eu-central-2");
// after: use a supported SSO OIDC region
await svc.registerClient("us-east-1");

const VALID_REGIONS = ["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-southeast-2"];
if (!VALID_REGIONS.includes(region)) throw new Error(`Unsupported SSO OIDC region: ${region}`);

function isNonEmpty(s) { return typeof s === 'string' && s.trim().length > 0; }
function validRegionArgs(r) { return isNonEmpty(r); }

try {
  return await svc.registerClient(region);
} catch (e) {
  if (/throttl|429|SlowDown/i.test(e.message)) {
    await sleep(2000);
    return svc.registerClient(region);
  }
  throw e;
}

When it happens

Trigger: POST to oidc.<region>.amazonaws.com/client/register returns !response.ok — e.g. an unsupported/typo'd region passed to registerClient, AWS rejecting the clientName/scopes/grantTypes payload, or network/AWS outage returning 4xx/5xx.

Common situations: Passing a region not valid for AWS SSO OIDC; AWS throttling (429) the register endpoint; a corporate proxy returning an HTML error page; KIRO_CONFIG constants drifted from what AWS currently accepts.

Related errors

• Failed to start device authorization: ${error}
• `CodeBuddy state request failed: ${await response.text()}`
• `CodeBuddy Intl state request failed: ${await response.text(
• Token refresh failed: ${error}
• Failed to list profiles: ${error}

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/49c11e5caac49c9f. Report an issue: GitHub.