decolua/9router · error

No authorization code received

Error message

No authorization code received

What it means

Thrown by IFlowService.connect() when the OAuth callback arrives but contains no `code` query parameter (and no `error` either). Per the authorization-code flow, iFlow must return ?code=...; its absence means the redirect was malformed or a non-standard response reached the local server. Without the code, the token exchange cannot proceed.

Source

Thrown at src/lib/oauth/services/iflow.js:176

        }, 300000);

        const checkInterval = setInterval(() => {
          if (callbackParams) {
            clearInterval(checkInterval);
            clearTimeout(timeout);
            resolve();
          }
        }, 100);
      });

      close();

      if (callbackParams.error) {
        throw new Error(callbackParams.error_description || callbackParams.error);
      }

      if (!callbackParams.code) {
        throw new Error("No authorization code received");
      }

      spinner.start("Exchanging code for tokens...");

      // Exchange code for tokens
      const tokens = await this.exchangeCode(callbackParams.code, redirectUri);

      spinner.text = "Fetching user info...";

      // Get user info (includes API key)
      const userInfo = await this.getUserInfo(tokens.access_token);

      spinner.text = "Saving tokens to server...";

      // Save tokens to server
      await this.saveTokens(tokens, userInfo);

      spinner.succeed(`iFlow connected successfully! (${userInfo.email || userInfo.phone})`);

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Re-run connect() and complete the browser login fully without manually editing the URL.
2. Inspect what query params actually arrived (add a console.log in the callback handler) to spot flow changes.
3. Check for iFlow API changes — if it now returns a token directly (implicit flow), update the handler.
4. Disable browser extensions/ad-blockers that might strip query parameters.
5. Verify the redirectUri used in buildAuthUrl matches the registered redirect for the client.

Example fix

// before
if (!callbackParams.code) {
  throw new Error("No authorization code received");
}
// after
if (!callbackParams.code) {
  throw new Error(`No authorization code received. Callback params: ${JSON.stringify(callbackParams)}`);
}

// Validate callback params before using them
function hasAuthCode(params) {
  return params != null && typeof params === "object" && typeof params.code === "string" && params.code.length > 0;
}
if (!hasAuthCode(callbackParams)) throw new Error("Callback missing ?code= — restart the OAuth flow");

function isCallbackWithCode(p) {
  return typeof p === "object" && p !== null && "code" in p && typeof p.code === "string";
}

try {
  await iflowService.connect();
} catch (err) {
  if (err.message === "No authorization code received") {
    console.error("Callback arrived without ?code= — close stale tabs and retry the login.");
  } else { throw err; }
}

When it happens

Trigger: The callback URL is hit with unexpected query params (e.g. only `state`, a `token`, or empty params) — caused by iFlow changing its redirect shape, the user manually editing the URL, a redirect to the bare callback path, or a browser extension stripping query strings.

Common situations: iFlow API/flow change altering callback parameters; user copy-pasting only part of the callback URL; local server receiving a favicon or health request interpreted as the callback; browser prefetch hitting the callback before the real redirect.

Related errors

• No authorization code received
• No authorization code received
• No authorization code received
• No authorization code received
• ${params.error_description || params.error}

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/ca61620217924b4f. Report an issue: GitHub.