different-ai/openwork · error · ProbeFailure

AUTH_TOKEN_ACQUISITION

AUTH_TOKEN_ACQUISITION

Error message

Token response did not match the selected provider profile

What it means

After a successful token exchange, the probe validates the token payload against the provider profile: for `tokenResponseStyle: "slack-user"` it requires token_type === "user" and ok === true; otherwise it requires token_type === "Bearer". A token endpoint that returns a token in the wrong style (or wrong token_type casing/value) fails profile conformance, so the probe throws AUTH_TOKEN_ACQUISITION / oauth_token.

Source

Thrown at packages/enterprise-mcp-mock-server/src/testing/probe.ts:688

    if (tokenAuthMethod === "client_secret_post") tokenForm.set("client_secret", clientSecret)
    const tokenResponse = await expectOk(
      await fetchStep(tokenEndpoint, {
        method: "POST",
        headers: { "content-type": "application/x-www-form-urlencoded" },
        body: tokenForm,
      }, "AUTH_TOKEN_ACQUISITION", overallDeadline),
      "AUTH_TOKEN_ACQUISITION",
    )
    const token = parseAt(
      tokenResponseSchema,
      await parseJson(tokenResponse, "AUTH_TOKEN_ACQUISITION", "oauth_token"),
      "AUTH_TOKEN_ACQUISITION",
      "oauth_token",
      "Token response did not match the required shape",
    )
    const expectedTokenType = profile.oauth.tokenResponseStyle === "slack-user" ? "user" : "Bearer"
    if (token.token_type !== expectedTokenType || (expectedTokenType === "user" && token.ok !== true)) {
      throw new ProbeFailure("AUTH_TOKEN_ACQUISITION", "oauth_token", "Token response did not match the selected provider profile")
    }
    accessToken = token.access_token
    refreshToken = token.refresh_token
    sensitiveValues.push(accessToken, refreshToken)
    recordPassed(phases, "AUTH_TOKEN_ACQUISITION", startedAt, "Authorization code and PKCE token exchange passed")

    if (activeFault?.effect === "refresh-expired") {
      startedAt = Date.now()
      const refreshForm = new URLSearchParams({
        grant_type: "refresh_token",
        client_id: clientId,
        refresh_token: refreshToken,
      })
      if (tokenAuthMethod === "client_secret_post") refreshForm.set("client_secret", clientSecret)
      const refreshResponse = await fetchStep(tokenEndpoint, {
        method: "POST",
        headers: { "content-type": "application/x-www-form-urlencoded" },
        body: refreshForm,

View on GitHub (pinned to 2b7df46e8a)

Solutions

Fix the token endpoint to return token_type exactly matching the profile: "Bearer" for standard profiles, or token_type "user" with ok: true for slack-user profiles.
Select the provider profile whose tokenResponseStyle matches the actual server behavior.
Check whether a server/framework change altered token_type casing or added wrapper fields and update either side.

Example fix

// before (token endpoint)
res.json({ access_token: at, token_type: "bearer" })
// after
res.json({ access_token: at, token_type: "Bearer" })

Defensive patterns

Strategy: validation

Validate before calling

const token = await tokenEndpointResponse.json()
const expected = profile.oauth.tokenResponseStyle === 'slack-user' ? 'user' : 'Bearer'
if (token.token_type !== expected || (expected === 'user' && token.ok !== true)) {
  throw new Error(`token_type ${token.token_type} does not match profile style ${expected}`)
}

Type guard

function matchesProfileToken(t, style) { return style === 'slack-user' ? t.token_type === 'user' && t.ok === true : t.token_type === 'Bearer' }

Prevention

Keep token-endpoint implementations and provider-profile tokenResponseStyle in one tested contract.
Assert token_type casing in the mock AS's own unit tests.
Update profiles whenever the upstream provider changes its token response shape.

When it happens

Trigger: The token endpoint returns a JSON body whose token_type does not match the profile's expected style (e.g. "bearer" lowercase vs "Bearer", or "user" when Bearer is expected), or the slack-user style response has ok !== true, at probe.ts:684-686.

Common situations: Mock AS returning lowercase "bearer" while the profile expects "Bearer"; selecting the wrong provider profile for the target (Slack-style vs standard OAuth); a server update changing the token response shape.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/ebc92fb06a642b84. Report an issue: GitHub.