decolua/9router · error

No authorization code received

Error message

No authorization code received

What it means

Thrown by the local callback server's waitForCallback() after the browser redirect lands but the callback query params contain no `code`. The generic OAuthService expects every authorization-code flow redirect to carry `?code=...`; if the provider returned params without a code (and without an `error` param, which is checked first), the flow cannot continue to the token exchange. It signals a malformed or unexpected callback rather than an explicit provider-declared failure.

Source

Thrown at src/lib/oauth/services/oauth.js:76

          const checkInterval = setInterval(() => {
            if (callbackParams) {
              clearInterval(checkInterval);
              clearTimeout(timeout);
              resolve();
            }
          }, 100);
        });

        spinner.stop();
        close();

        if (callbackParams.error) {
          throw new Error(callbackParams.error_description || callbackParams.error);
        }

        if (!callbackParams.code) {
          throw new Error("No authorization code received");
        }

        return callbackParams;
      },
    };
  }

  /**
   * Exchange authorization code for tokens
   */
  async exchangeCode(code, redirectUri, codeVerifier, contentType = "application/x-www-form-urlencoded") {
    const body =
      contentType === "application/json"
        ? JSON.stringify({
            grant_type: "authorization_code",
            client_id: this.config.clientId,
            code: code,
            redirect_uri: redirectUri,

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Re-run the auth flow and complete the full browser login; make sure you don't stop at an intermediate redirect page.
2. Check the provider's docs/console for the exact redirect behavior and whether it uses a param other than `code`; add it to extraParams or map it in the callback handler.
3. If pasting the URL manually, copy the entire redirect URL including all query parameters from the address bar.
4. Log the full callbackParams before this throw to see exactly which params the provider sent.

Example fix

// before (diagnosing)
if (!callbackParams.code) {
  throw new Error("No authorization code received");
}
// after (log what actually arrived)
if (!callbackParams.code) {
  throw new Error(`No authorization code received; got params: ${JSON.stringify(Object.keys(callbackParams))}`);
}

// Before starting the flow, know what a valid callback looks like; after redirect, inspect params yourself:
const url = new URL(redirectRequestUrl);
if (!url.searchParams.get("code")) {
  console.error("Callback missing code; params:", Object.fromEntries(url.searchParams));
  // surface provider error if present instead of proceeding
}

function hasAuthorizationCode(params) {
  return params != null && typeof params === "object" && typeof params.code === "string" && params.code.length > 0;
}

try {
  const params = await flow.waitForCallback();
} catch (err) {
  if (err.message === "No authorization code received") {
    // restart the flow with a fresh state/PKCE pair
  } else throw err;
}

When it happens

Trigger: startAuthFlow() -> waitForCallback(): the local server receives a GET whose query params pass the `!callbackParams.error` check but lack `code` — e.g. the provider redirected with a different param name, or the user pasted a truncated/partial callback URL, or the provider redirected to `/callback` with only `state`/`session_state` after a silent re-auth.

Common situations: Provider changed its redirect contract (extra params, renamed code param); user manually copy-pasted only part of the redirect URL into the browser; an identity provider did a soft redirect back with session cookies but no new code; corporate proxies stripping query strings from localhost redirects.

Related errors

• No authorization code received
• ${callbackParams.error_description || callbackParams.error}
• No authorization code received
• No authorization code received
• No authorization code received

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/a366228532530109. Report an issue: GitHub.