decolua/9router · error

Only external_idp Kiro auth is supported by this importer

Error message

Only external_idp Kiro auth is supported by this importer

What it means

The importer only supports Kiro auth entries whose auth_method (or authMethod) is 'external_idp'. If the parsed auth document declares a different auth method, this error is thrown to stop the import early. Omitting auth_method entirely is allowed (treated as external_idp).

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:93

}

export function normalizeKiroExternalIdpAuth(rawAuth) {
  let input = rawAuth;
  if (typeof input === "string") {
    try {
      input = JSON.parse(input);
    } catch {
      throw new Error("CLIProxyAPI auth JSON is invalid");
    }
  }

  if (!input || typeof input !== "object") {
    throw new Error("CLIProxyAPI auth JSON is required");
  }

  const authMethod = normalizeString(input.auth_method || input.authMethod);
  if (authMethod && authMethod !== "external_idp") {
    throw new Error("Only external_idp Kiro auth is supported by this importer");
  }

  const accessToken = normalizeString(input.access_token || input.accessToken);
  const refreshToken = normalizeString(input.refresh_token || input.refreshToken);
  const clientId = normalizeString(input.client_id || input.clientId);
  const tokenEndpoint = validateMicrosoftTokenEndpoint(input.token_endpoint || input.tokenEndpoint);
  const profileArn = normalizeString(input.profile_arn || input.profileArn);
  const region = normalizeString(input.region) || DEFAULT_REGION;
  const scope = normalizeScope(input.scopes || input.scope);

  if (!accessToken) throw new Error("access_token is required");
  if (!refreshToken) throw new Error("refresh_token is required");
  if (!clientId) throw new Error("client_id is required");
  if (!scope) throw new Error("scopes is required");
  if (!profileArn) throw new Error("profile_arn is required");

  const payload = decodeJwtPayload(accessToken);
  const email = input.email || payload?.email || payload?.preferred_username || payload?.upn || payload?.sub || null;

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Re-authenticate via the Microsoft external IdP flow so the auth file has auth_method: 'external_idp'
2. Remove the auth_method field if you are certain the entry is external-IdP-based (absent means accepted)
3. Use the importer path appropriate for the auth method present instead of this external-IdP importer
4. Check for CLIProxyAPI/9router updates in case new auth methods gained importer support

Example fix

// before
{ "auth_method": "builderid", "access_token": "...", ... }
// after
{ "auth_method": "external_idp", "access_token": "...", ... }

const method = typeof auth.auth_method === 'string' ? auth.auth_method.trim() : (auth.authMethod || '');
if (method && method !== 'external_idp') {
  throw new Error(`Auth method '${method}' not supported; only external_idp`);
}

function isExternalIdpAuth(auth) {
  const m = (auth.auth_method ?? auth.authMethod ?? 'external_idp').trim();
  return m === 'external_idp';
}

try {
  normalizeKiroExternalIdpAuth(auth);
} catch (e) {
  if (e.message.startsWith('Only external_idp')) {
    console.error('Re-authenticate via the Microsoft external IdP flow for this importer');
  }
  throw e;
}

When it happens

Trigger: Calling normalizeKiroExternalIdpAuth with an auth JSON whose auth_method is e.g. 'social', 'builderid', 'idc', or any value other than 'external_idp'.

Common situations: Importing a Kiro auth file produced by a different login flow (Google/BuilderID/IdC login) instead of the Microsoft external IdP flow; an outdated CLIProxyAPI writing a new auth_method value the importer predates.

Related errors

• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token
• Missing xAI authorization code
• Missing accessToken

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/fb3a8cb01a800e0b. Report an issue: GitHub.