decolua/9router · error

token_endpoint is required

Error message

token_endpoint is required

What it means

Kiro can use an external Microsoft IdP whose token_endpoint must be supplied/validated. validateMicrosoftTokenEndpoint first requires a non-empty value after trimming; an empty, missing, or whitespace-only token_endpoint throws this error.

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:16

const MICROSOFT_TOKEN_ENDPOINT_HOSTS = new Set([
  "login.microsoftonline.com",
  "login.microsoft.com",
  "login.windows.net",
]);

const DEFAULT_REGION = "us-east-1";
const DEFAULT_EXPIRES_IN = 3600;

function normalizeString(value) {
  return typeof value === "string" ? value.trim() : "";
}

export function validateMicrosoftTokenEndpoint(rawEndpoint) {
  const tokenEndpoint = normalizeString(rawEndpoint);
  if (!tokenEndpoint) throw new Error("token_endpoint is required");

  let parsed;
  try {
    parsed = new URL(tokenEndpoint);
  } catch {
    throw new Error("token_endpoint must be a valid URL");
  }

  if (parsed.protocol !== "https:") {
    throw new Error("token_endpoint must use https");
  }

  const host = parsed.hostname.toLowerCase();
  if (!MICROSOFT_TOKEN_ENDPOINT_HOSTS.has(host)) {
    throw new Error("token_endpoint must be a Microsoft login endpoint");
  }

  return parsed.toString();

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Set the token_endpoint on the Kiro external IdP config, e.g. https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token.
2. Re-fetch the OIDC discovery document (https://login.microsoftonline.com/<tenant>/.well-known/openid-configuration) and copy its token_endpoint value.
3. If loading from env/config, confirm the variable is set and not whitespace-only.

Example fix

// before
const endpoint = process.env.MS_TOKEN_ENDPOINT; // undefined
validateMicrosoftTokenEndpoint(endpoint);
// after
const endpoint = process.env.MS_TOKEN_ENDPOINT ||
  `https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token`;
validateMicrosoftTokenEndpoint(endpoint);

const raw = idpConfig.token_endpoint;
if (typeof raw !== "string" || raw.trim() === "") {
  throw new Error("External IdP config is missing token_endpoint — copy it from the OIDC discovery document");
}
validateMicrosoftTokenEndpoint(raw);

function hasTokenEndpoint(cfg) {
  return typeof cfg?.token_endpoint === "string" && cfg.token_endpoint.trim().length > 0;
}

try {
  endpoint = tokenEndpoint(idpConfig);
} catch (err) {
  if (err.message === "token_endpoint is required") {
    throw new Error("Kiro external IdP metadata incomplete: re-fetch openid-configuration");
  }
  throw err;
}

When it happens

Trigger: Calling tokenEndpoint()/validateMicrosoftTokenEndpoint(undefined), with "", or with " " — usually because the IdP discovery document lacked token_endpoint or the stored Kiro external-IdP config omitted the field.

Common situations: Misconfigured external IdP in the Kiro account settings where only authorization_endpoint was pasted; a discovery/metadata fetch that returned a partial document; migrating config where the token endpoint field got dropped.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token
• Missing xAI authorization code
• Missing accessToken

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/0dcaf02cc207387e. Report an issue: GitHub.