decolua/9router · error

Token validation failed: ${error.message}

Error message

Token validation failed: ${error.message}

What it means

Thrown by KiroService.validateImportToken when the token format passed the aorAAAAAG check but the subsequent refreshToken() probe failed. The original error's message is re-wrapped, so the root cause (usually the upstream body from errors 284/285) is preserved in the text. It means the pasted refresh token is well-formed but not actually usable — invalid, revoked, or expired.

Source

Thrown at src/lib/oauth/services/kiro.js:258

   */
  async validateImportToken(refreshToken) {
    // Validate token format
    if (!refreshToken.startsWith("aorAAAAAG")) {
      throw new Error("Invalid token format. Token should start with aorAAAAAG...");
    }

    // Try to refresh to validate
    try {
      const result = await this.refreshToken(refreshToken);
      return {
        accessToken: result.accessToken,
        refreshToken: result.refreshToken || refreshToken,
        profileArn: result.profileArn,
        expiresIn: result.expiresIn,
        authMethod: "imported",
      };
    } catch (error) {
      throw new Error(`Token validation failed: ${error.message}`);
    }
  }

  /**
   * List available CodeWhisperer profiles for OAuth/IDC tokens and return the
   * best-matching profileArn. API keys use the Amazon Q model catalog instead;
   * ListAvailableProfiles does not support TokenType=API_KEY.
   */
  async listAvailableProfiles(accessToken, region = "us-east-1") {
    assertValidAwsRegion(region);
    const endpoint = `https://codewhisperer.${region}.amazonaws.com`;

    const response = await fetch(endpoint, {
      method: "POST",
      headers: {
        "Content-Type": "application/x-amz-json-1.0",
        "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
        "Authorization": `Bearer ${accessToken}`,

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Read the wrapped message for the root cause: invalid/revoked tokens require re-auth in Kiro and a fresh export.
2. Export the refresh token again from a currently-logged-in Kiro session and retry immediately.
3. If the token came from an AWS SSO (device-flow) login, it may need the OIDC refresh path — check which auth method produced it.
4. Retry later if the embedded message indicates a server-side 5xx rather than an auth rejection.

Example fix

// before: silent import retry with stale token
try { await svc.validateImportToken(old); } catch { await svc.validateImportToken(old); }
// after: prompt re-export on failure
catch (e) {
  if (/Invalid|revoked|expired/i.test(e.message)) promptUserToReExport();
  else throw e;
}

// format check first so only the refresh probe can fail
if (!token.trim().startsWith('aorAAAAAG')) throw new Error('Not a Kiro refresh token');
// optional liveness hint: token must be a plausible length
if (token.trim().length < 30) throw new Error('Refresh token looks truncated');

function isImportResult(r) { return typeof r?.accessToken === 'string' && r?.authMethod === 'imported'; }

try {
  return await svc.validateImportToken(token);
} catch (e) {
  // e.message embeds the root cause from refreshToken — surface it verbatim
  if (/Invalid|revoked|expired|invalid_grant/i.test(e.message)) {
    return promptReExportToken(e.message);
  }
  throw e; // transient/network — let caller retry
}

When it happens

Trigger: validateImportToken calls this.refreshToken(token) (social path, since no clientId/secret is passed) and it throws — invalid_grant, revoked token, or Kiro auth service returning non-2xx; the catch block rethrows as `Token validation failed: ${error.message}`.

Common situations: Importing a Kiro refresh token that was already rotated/revoked (e.g. exported from an old session); token from a revoked device authorization; Kiro service outage at import time; accidentally importing an AWS SSO refresh token that only works via the OIDC endpoint, not the social refreshToken endpoint.

Related errors

• Invalid token format. Token should start with aorAAAAAG...
• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token
• Missing xAI authorization code

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/b76e247cc4a815b5. Report an issue: GitHub.