What causes "profile_arn is required" in decolua/9router?

Add profile_arn (or profileArn) with the ARN from the CLIProxyAPI auth file (arn:aws:...:profile/... form)

profile_arn is required

Error message

profile_arn is required

What it means

profile_arn (or profileArn) — the AWS CodeWhriter/Kiro profile ARN — is required by this importer. It identifies which Kiro profile the credential operates against and is stored in providerSpecificData for API calls. Missing or empty profile_arn aborts the import.

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:108

  const authMethod = normalizeString(input.auth_method || input.authMethod);
  if (authMethod && authMethod !== "external_idp") {
    throw new Error("Only external_idp Kiro auth is supported by this importer");
  }

  const accessToken = normalizeString(input.access_token || input.accessToken);
  const refreshToken = normalizeString(input.refresh_token || input.refreshToken);
  const clientId = normalizeString(input.client_id || input.clientId);
  const tokenEndpoint = validateMicrosoftTokenEndpoint(input.token_endpoint || input.tokenEndpoint);
  const profileArn = normalizeString(input.profile_arn || input.profileArn);
  const region = normalizeString(input.region) || DEFAULT_REGION;
  const scope = normalizeScope(input.scopes || input.scope);

  if (!accessToken) throw new Error("access_token is required");
  if (!refreshToken) throw new Error("refresh_token is required");
  if (!clientId) throw new Error("client_id is required");
  if (!scope) throw new Error("scopes is required");
  if (!profileArn) throw new Error("profile_arn is required");

  const payload = decodeJwtPayload(accessToken);
  const email = input.email || payload?.email || payload?.preferred_username || payload?.upn || payload?.sub || null;

  return {
    accessToken,
    refreshToken,
    expiresAt: resolveExpiresAt(input),
    email,
    providerSpecificData: {
      profileArn,
      region,
      authMethod: "external_idp",
      provider: "CLIProxyAPI",
      clientId,
      tokenEndpoint,
      scope,
    },

View on GitHub (pinned to 90b52e06ff)

Solutions

Add profile_arn (or profileArn) with the ARN from the CLIProxyAPI auth file (arn:aws:...:profile/... form)
Re-export the auth document from CLIProxyAPI — the Kiro login flow records profile_arn automatically
Verify the ARN string has no leading/trailing whitespace-only content (trim is applied, then emptiness checked)
Confirm you are importing a Kiro external-IdP auth file, not a plain Microsoft OAuth blob

Example fix

// before
{ "access_token": "...", "refresh_token": "...", "client_id": "...", "scopes": "openid" }
// after
{ "access_token": "...", "refresh_token": "...", "client_id": "...", "scopes": "openid", "profile_arn": "arn:aws:codewhisperer:us-east-1:123456789012:profile/ABCDEF" }

Defensive patterns

Strategy: validation

Validate before calling

const arn = auth.profile_arn ?? auth.profileArn;
if (typeof arn !== 'string' || !arn.trim()) throw new Error('profile_arn missing from Kiro auth');

Type guard

function hasProfileArn(a) {
  return typeof a === 'object' && a !== null &&
    ['profile_arn', 'profileArn'].some(k => typeof a[k] === 'string' && a[k].trim() !== '');
}

Try / catch

try {
  normalizeKiroExternalIdpAuth(auth);
} catch (e) {
  if (e.message === 'profile_arn is required') {
    console.error('Auth doc lacks the Kiro profile ARN; re-export from CLIProxyAPI');
  }
  throw e;
}

Prevention

Import genuine Kiro auth files, not generic Microsoft OAuth responses
Keep profile_arn together with the OAuth fields in the same document
Validate the ARN format (arn:aws:...) in your pre-flight checks
Take all fields from a single export — do not mix documents

When it happens

Trigger: Auth JSON lacking profile_arn/profileArn or containing an empty/whitespace value; importing a generic Microsoft OAuth document that has tokens but no Kiro profile metadata.

Common situations: Building the auth JSON manually from an Entra token response and forgetting the Kiro-specific profile_arn; copying only the OAuth half of a CLIProxyAPI auth file; ARN field stored under a custom key the importer doesn't recognize.

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/d420a1b10933f065. Report an issue: GitHub.