decolua/9router · error · Error

Missing Zed callback URL

Error message

Missing Zed callback URL

What it means

parseZedCallbackPayload converts the pasted native-app callback URL/JSON/query into { userId, encryptedAccessToken }. It throws when the input string is empty after trimming — there is no callback data to parse at all. It is the first guard before JSON/URL parsing, so it means the caller supplied nothing rather than malformed data.

Source

Thrown at open-sse/shared/zedAuth.js:104

    `${normalizeBaseUrl(config.webBaseUrl, ZED_WEB_BASE_URL)}/native_app_signin`,
  );
  signInUrl.searchParams.set("native_app_port", String(nativeAppPort));
  signInUrl.searchParams.set("native_app_public_key", publicKeyString);
  if (systemId) signInUrl.searchParams.set("system_id", systemId);

  return {
    authUrl: signInUrl.toString(),
    privateKeyVerifier: encodeZedPrivateKeyVerifier(privateKey),
    nativeAppPort,
    systemId,
    publicKey: publicKeyString,
  };
}

/** Parse the pasted native-app callback URL/JSON/query into userId + encrypted token. */
export function parseZedCallbackPayload(input) {
  const raw = String(input || "").trim();
  if (!raw) throw new Error("Missing Zed callback URL");

  let data = {};
  try {
    data = JSON.parse(raw);
  } catch {
    let url;
    try {
      url = new URL(raw);
    } catch {
      try {
        url = new URL(`http://127.0.0.1/?${raw.replace(/^\?/, "")}`);
      } catch {
        throw new Error("Invalid Zed callback URL");
      }
    }
    url.searchParams.forEach((value, key) => {
      data[key] = value;
    });

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Paste the full zed.dev callback URL (or its JSON) into the login form and retry
2. Check the UI/state binding so the input variable actually contains the pasted value before calling
3. Validate non-empty input client-side before invoking parseZedCallbackPayload
4. If automating, ensure the callback URL was captured completely (query string included)

Example fix

// before
const { userId, encryptedAccessToken } = parseZedCallbackPayload(input.value);
// after
if (!input.value?.trim()) throw new Error("Paste the Zed callback URL first");
const { userId, encryptedAccessToken } = parseZedCallbackPayload(input.value);

function hasZedCallbackInput(input) {
  return typeof input === "string" && input.trim().length > 0;
}
if (!hasZedCallbackInput(pasted)) alert("Paste the zed.dev callback URL first");

try {
  const { userId, encryptedAccessToken } = parseZedCallbackPayload(pasted);
} catch (e) {
  if (/Missing Zed callback URL/.test(e.message)) {
    return showFormError("Callback URL is required");
  }
  throw e;
}

When it happens

Trigger: Calling parseZedCallbackPayload with undefined, null, '', or whitespace-only input — e.g. the user clicked 'finish login' without pasting the callback URL, or the UI passed an unset state variable.

Common situations: Incomplete paste from the browser into the dashboard OAuth form; form binding not wired so the field is empty; script passing a variable before it is assigned; clipboard copy failed silently.

Related errors

• Missing Zed private key verifier; restart the login flow
• Invalid Zed callback URL
• Zed callback must include user_id and access_token
• Zed credential is missing userId or accessToken
• No Zed organization selected

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/51bdcb31cc7b9a9a. Report an issue: GitHub.