diegosouzapw/OmniRoute · error

Token refresh retry failed after re-registration

Error message

Token refresh retry failed after re-registration: ${retryError}

What it means

Terminal failure in KiroService.refreshToken's self-healing path: the initial refresh failed (often because the cached client registration became invalid), the code re-registered the OIDC client and retried the refresh with the new clientId/clientSecret, and that retry also failed. The connection's stored credentials can no longer be refreshed without operator action.

Solutions

  1. Inspect the wrapped retryError body for the AWS error code
  2. Mark the Kiro connection as expired/reauth-required and prompt the user to re-authenticate
  3. Verify region and startUrl consistency between registration and refresh
  4. If AWS-side outage, retry later before declaring the token dead
Defensive patterns

Strategy: retry

When it happens

Trigger: Thrown at src/lib/oauth/services/kiro.ts:270 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/1390146e9cd17826. Report an issue: GitHub.

Appendix: source

Thrown at src/lib/oauth/services/kiro.ts:270

              clientSecret: newReg.clientSecret,
              refreshToken,
              grantType: "refresh_token",
            }),
          });

          if (retryRes.ok) {
            const retryData = await retryRes.json();
            return {
              accessToken: retryData.accessToken,
              refreshToken: retryData.refreshToken || refreshToken,
              expiresIn: retryData.expiresIn || 3600,
              _newClientId: newReg.clientId,
              _newClientSecret: newReg.clientSecret,
              _newClientSecretExpiresAt: newReg.clientSecretExpiresAt,
            };
          } else {
            const retryError = await retryRes.text();
            throw new Error(`Token refresh retry failed after re-registration: ${retryError}`);
          }
        } catch (reRegErr) {
          if (reRegErr.message?.includes("Token refresh retry failed")) throw reRegErr;
          console.warn("[kiro refresh] Re-registration fallback failed:", reRegErr);
        }

        const error = await response.text();
        throw new Error(`Token refresh failed: ${error}`);
      }

      const data = await response.json();
      return {
        // Builder ID / IDC OIDC refresh: no profileArn (the social path supplies
        // one; Builder ID connections legitimately have none). expiresIn falls
        // back to 3600 so the import route never computes Date(NaN) if upstream
        // omits it (the social path already guards the same way).
        accessToken: data.accessToken,
        refreshToken: data.refreshToken || refreshToken,

View on GitHub (pinned to a179ffed5b)