decolua/9router · error

No token was returned by the Kimchi authentication server

Error message

No token was returned by the Kimchi authentication server

What it means

Thrown by KimchiService._handleCallback() when the callback passes the error and state checks but carries no `token` query parameter. Kimchi's simplified browser login delivers the access token directly on the callback URL (no code exchange); its absence means the Kimchi web app redirected back without completing token issuance.

Source

Thrown at src/lib/oauth/services/kimchi.js:83

      setTimeout(() => sessions.delete(state), SESSION_TTL_MS).unref?.();
    });

    const callbackUrl = `http://127.0.0.1:${port}${KIMCHI_CONFIG.callbackPath}`;
    const authUrl = buildKimchiAuthUrl(callbackUrl, state);
    return { authUrl, port, state, result, close };
  }

  async _handleCallback(params, expectedState) {
    if (params.error) {
      throw new Error(params.error_description || params.error);
    }
    const candidate = params.state;
    if (!candidate || candidate !== expectedState) {
      throw new Error("This request isn't valid. Please restart the Kimchi login flow.");
    }
    const token = params.token;
    if (!token) {
      throw new Error("No token was returned by the Kimchi authentication server");
    }
    const check = await this.validateToken(token);
    if (!check.valid) {
      throw new Error(check.error || "Kimchi token validation failed");
    }
    return { token };
  }

  async fetchProfile(token) {
    try {
      const res = await fetch(KIMCHI_CONFIG.meUrl, {
        headers: { Authorization: `Bearer ${token}` },
      });
      if (!res.ok) return {};
      const j = await res.json();
      return { displayName: j.name, email: j.email, username: j.username };
    } catch {
      return {};

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Restart the Kimchi login flow and complete all steps in the browser until fully finished.
2. Check whether the Kimchi web app still puts the token in the `token` query param (API change → update this handler).
3. Look at the Kimchi web app/backend logs for token-issuance failures on your account.
4. Retry later if Kimchi reports a transient backend problem.

Example fix

// before
if (!token) {
  throw new Error("No token was returned by the Kimchi authentication server");
}
// after
if (!token) {
  throw new Error(`No token was returned by the Kimchi authentication server. Callback params: ${Object.keys(params).join(", ") || "(none)"}`);
}

// Check the token param before proceeding
function hasToken(params) {
  return params != null && typeof params.token === "string" && params.token.length > 0;
}

function isTokenCallback(p) {
  return typeof p === "object" && p !== null && typeof p.token === "string" && p.token.length > 0;
}

try {
  const outcome = await session.result;
  if (outcome.error && /No token was returned/.test(outcome.error)) {
    console.error("Callback had a valid state but no token — Kimchi failed to issue one; retry the login.");
  }
} catch { /* errors are resolved into the result, not rejected */ }

When it happens

Trigger: The Kimchi web app redirects to the local callback with a valid `state` but no `token` — login succeeded partially (e.g. account selection done but token issuance failed), the web app's token-generation step errored, or a non-auth request with a matching state reached the server.

Common situations: Kimchi backend failing to mint a token after successful auth; a truncated/partial redirect; the web app version changing callback shape so the token lands under a different param name; retry logic hitting the callback endpoint without token.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ${params.error_description || params.error}
• No authorization code received
• No authorization code received
• No authorization code received
• No authorization code received

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/77834c326d57a395. Report an issue: GitHub.