What causes "Invalid token format. Token should start with aorAAAAAG..." in diegosouzapw/OmniRoute?

Invalid token format. Token should start with aorAAAAAG...

Error message

Invalid token format. Token should start with aorAAAAAG...

What it means

Error "Invalid token format. Token should start with aorAAAAAG..." thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/oauth/services/kiro.ts:332

      expiresIn: data.expiresIn || 3600,
    };
  }

  /**
   * Validate and import refresh token.
   * First attempts to validate using cached AWS SSO client credentials (Builder ID path).
   * If that fails or no cached credentials exist, registers a dedicated OIDC client.
   * If registerClient() also fails, the import falls back to the shared social-auth refresh path.
   */
  async validateImportToken(
    refreshToken: string,
    region: string = "us-east-1",
    clientIdHint?: string
  ) {
    assertValidAwsRegion(region);
    // Validate token format
    if (!refreshToken.startsWith("aorAAAAAG")) {
      throw new Error("Invalid token format. Token should start with aorAAAAAG...");
    }

    // Try to read cached clientId/clientSecret from AWS SSO cache (Builder ID tokens).
    // When the caller knows the token's own clientId (#1253 — e.g. surfaced by
    // auto-import from a direct `clientId` field on the token file), pass it
    // through so the cache lookup can match it exactly instead of guessing via
    // region + latest-expiry, which can silently adopt an unrelated stale
    // client registration on hosts with multiple cached SSO sessions.
    const cachedClient = await this.readCachedClientCredentials(region, clientIdHint);

    // Attempt 1: Try Builder ID refresh using cached credentials
    if (cachedClient) {
      try {
        const result = await this.refreshToken(refreshToken, {
          clientId: cachedClient.clientId,
          clientSecret: cachedClient.clientSecret,
          authMethod: "builder-id",
          // Forward the requested region so a non-us-east-1 Builder ID validates

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/oauth/services/kiro.ts:332 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/c9f87bb5a1cfcb49. Report an issue: GitHub.