different-ai/openwork · error
`${t("providers.not_oauth_flow_prefix")} ${resolved}.`
Error message
`${t("providers.not_oauth_flow_prefix")} ${resolved}.` What it means
After resolving oauthIndex, startProviderOAuth re-finds the selected method and validates that it exists and its type is exactly "oauth" before calling c.provider.oauth.authorize. If the method at that index is missing or has a different type, the store throws not_oauth_flow_prefix. This is a defensive consistency check between the resolved index and the actual method list.
Source
Thrown at apps/app/src/react-app/domains/connections/provider-auth/store.ts:1435
const methods = authMethods[resolved];
if (!methods || !methods.length) {
throw new Error(`${t("providers.unknown_provider")}: ${resolved}`);
}
const oauthIndex =
methodIndex !== undefined
? methodIndex
: methods.find((method) => method.type === "oauth")?.methodIndex ?? -1;
if (oauthIndex === -1) {
throw new Error(
`${t("providers.no_oauth_prefix")} ${resolved}. ${t("providers.use_api_key_suffix")}`,
);
}
const selectedMethod = methods.find((method) => method.methodIndex === oauthIndex);
if (!selectedMethod || selectedMethod.type !== "oauth") {
throw new Error(`${t("providers.not_oauth_flow_prefix")} ${resolved}.`);
}
const auth = unwrap(
await c.provider.oauth.authorize({ providerID: resolved, method: oauthIndex }),
);
return { methodIndex: oauthIndex, authorization: auth };
} catch (error) {
const message = describeProviderError(error, t("providers.connect_failed"));
setStateField("providerAuthError", message);
throw error instanceof Error ? error : new Error(message);
}
}
async function refreshProviders(optionsArg?: { dispose?: boolean; force?: boolean }) {
const c = options.client();
if (!c) return null;
if (optionsArg?.dispose) {View on GitHub (pinned to 2b7df46e8a)
Solutions
- Omit methodIndex and let the store auto-select the first OAuth method.
- Refresh providerAuthMethods from the server and use a methodIndex from the current list.
- Verify the method at that index actually has type === "oauth" before calling.
- Avoid persisting methodIndex across server config changes; re-resolve each session.
Example fix
// before
await startProviderOAuth("anthropic", 0); // index 0 is api-key
// after
await startProviderOAuth("anthropic"); // auto-pick first oauth method Defensive patterns
Strategy: validation
Validate before calling
const methods = authMethods[providerId] ?? [];
const selected = methods.find((m) => m.methodIndex === methodIndex);
if (!selected || selected.type !== "oauth") {
// omit methodIndex to auto-select the first oauth method
await store.startProviderOAuth(providerId);
return;
}
await store.startProviderOAuth(providerId, methodIndex); Type guard
function isOAuthMethod(m: ProviderAuthMethod | undefined): m is ProviderAuthMethod & { type: "oauth" } {
return m?.type === "oauth";
} Try / catch
try {
await store.startProviderOAuth(providerId, methodIndex);
} catch (e) {
if (e instanceof Error && /not.{0,5}oauth/i.test(e.message)) {
void store.refreshProviderAuthMethods().then(() => store.startProviderOAuth(providerId));
} else throw e;
} Prevention
- Prefer omitting methodIndex so the store auto-picks the first OAuth method.
- Never persist methodIndex across sessions or server config changes.
- Always derive indexes from a freshly fetched method list.
- Re-fetch methods if the server may have been reconfigured mid-flow.
When it happens
Trigger: Calling startProviderOAuth with a methodIndex that does not exist in methods (no method has that methodIndex), or that resolves to a method whose type is not "oauth" (e.g. 'api'), for providerId `resolved`.
Common situations: Hardcoded/stale methodIndex from a previous server response whose ordering changed; cached providerAuthMethods out of sync with the server's current method list; caller passed index 0 assuming OAuth when index 0 is an api-key method; concurrent reconfiguration changed methods between listing and authorize.
Related errors
- `${t("providers.no_oauth_prefix")} ${resolved}. ${t("provide
- t("providers.oauth_method_required")
- OpenWork-managed OAuth requires a remote MCP URL.
- An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.
- An enterprise MCP OAuth redirect URI cannot contain credenti
AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01).
Data as JSON: /api/errors/03fc8eaad09d88ef.
Report an issue: GitHub.