decolua/9router · error

Invalid token format. Token should start with aorAAAAAG...

Error message

Invalid token format. Token should start with aorAAAAAG...

What it means

Thrown by KiroService.validateImportToken when a manually pasted refresh token does not start with the required prefix "aorAAAAAG". Kiro/AWS refresh tokens have this literal prefix, so the check is a cheap pre-flight before spending a network round-trip on refreshToken(). It indicates the pasted string is not a Kiro refresh token (wrong token type, truncated, or from another provider).

Source

Thrown at src/lib/oauth/services/kiro.js:244

      throw new Error(`Token refresh failed: ${error}`);
    }

    const data = await response.json();
    return {
      accessToken: data.accessToken,
      refreshToken: data.refreshToken || refreshToken,
      profileArn: data.profileArn,
      expiresIn: data.expiresIn || 3600,
    };
  }

  /**
   * Validate and import refresh token
   */
  async validateImportToken(refreshToken) {
    // Validate token format
    if (!refreshToken.startsWith("aorAAAAAG")) {
      throw new Error("Invalid token format. Token should start with aorAAAAAG...");
    }

    // Try to refresh to validate
    try {
      const result = await this.refreshToken(refreshToken);
      return {
        accessToken: result.accessToken,
        refreshToken: result.refreshToken || refreshToken,
        profileArn: result.profileArn,
        expiresIn: result.expiresIn,
        authMethod: "imported",
      };
    } catch (error) {
      throw new Error(`Token validation failed: ${error.message}`);
    }
  }

  /**

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Re-copy the full refresh token from the source and confirm it visibly starts with aorAAAAAG before importing.
2. Make sure you're copying the refresh token, not the access token or API key — only the refresh token carries this prefix.
3. Trim only whitespace, never the first characters; check the paste wasn't cut off at the start.
4. If the token genuinely lacks the prefix, it wasn't issued by Kiro's AWS flow and cannot be imported here.

Example fix

// before: importing an access token by mistake
await svc.validateImportToken(accessToken);
// after: verify prefix before calling
const rt = refreshToken.trim();
if (!rt.startsWith("aorAAAAAG")) throw new Error("Not a Kiro refresh token");
await svc.validateImportToken(rt);

function isKiroRefreshToken(t) {
  return typeof t === 'string' && t.trim().startsWith('aorAAAAAG') && t.trim().length > 30;
}
if (!isKiroRefreshToken(pasted)) {
  throw new Error('Paste a Kiro refresh token (starts with aorAAAAAG), not an access token or API key');
}

function isKiroRefreshToken(v) { return typeof v === 'string' && v.trim().startsWith('aorAAAAAG'); }

try {
  return await svc.validateImportToken(token);
} catch (e) {
  if (/Invalid token format/i.test(e.message)) {
    showHelpText('The refresh token starts with aorAAAAAG — check you copied the full token');
    return null;
  }
  throw e;
}

When it happens

Trigger: Calling validateImportToken with a token whose first characters are not "aorAAAAAG" — e.g. pasting an access token, an API key, an AWS secret key, or a token copied with leading whitespace trimmed away along with the prefix.

Common situations: Copy/paste truncation from a terminal; importing a token from a different tool (Cursor, CodeWhisperer API key); leading whitespace stripped along with the prefix by an editor; confusing the refresh token field with the access token field.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Token validation failed: ${error.message}
• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token
• Missing xAI authorization code

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/0740eeede3ccc70f. Report an issue: GitHub.