Authorization code not found. Please start the login process

Error message

Authorization code not found. Please start the login process again.

What it means

During the OAuth callback the server reads the `code` query parameter from the redirect request; if it is missing or empty it responds with HTTP 400 and this message. Without the authorization code the token exchange cannot proceed, so the flow is aborted and the user must restart login.

Source

Thrown at packages/cli/src/api/callback.ts:35

export function oauthCallbackServer({
  oauthClient,
  redirectUri,
  codeVerifier,
  spinner,
}: OAuthCallbackServerProps) {
  const server = http.createServer(async (req, res) => {
    const reqUrl = url.parse(req.url || "", true);

    if (reqUrl.pathname !== "/callback" || req.method !== "GET") {
      res.writeHead(404);
      res.end("Not found");
      return;
    }

    const code = reqUrl.query.code as string;

    if (!code) {
      res.writeHead(400);
      res.end(
        "Authorization code not found. Please start the login process again.",
      );

      return;
    }

    try {
      spinner.text = "Verifying";

      const { accessToken, refreshToken, expiresAt } =
        await oauthClient.authorizationCode.getToken({
          code,
          redirectUri,
          codeVerifier,
        });

      spinner.text = "Configuring";

View on GitHub (pinned to f216b94a24)

Solutions

Restart the login command (`login`) to begin a fresh OAuth flow.
On the provider's consent screen, click Allow/Authorize instead of Deny.
Verify the OAuth app configuration — some setups redirect with an error parameter instead of a code; inspect the full redirect URL in the browser address bar.
Check that no browser extension or proxy is stripping query parameters from the redirect.

Defensive patterns

Strategy: validation

Validate before calling

// Before starting the flow, ensure the authorize URL will include response_type=code
const authorizeUrl = oauthClient.authorizationCode.getAuthorizeURL({ redirectUri, scopes, codeVerifier });
if (!authorizeUrl.includes('response_type=code')) {
  throw new Error('Authorize URL must request response_type=code');
}

Type guard

function hasAuthorizationCode(query: Record<string, unknown>): query is Record<string, string> & { code: string } {
  return typeof query.code === 'string' && query.code.length > 0;
}

Try / catch

// Callback side: respond 400 instead of crashing when the code is absent
if (!hasAuthorizationCode(reqUrl.query)) {
  res.writeHead(400);
  res.end('Authorization code not found. Please start the login process again.');
  return;
}

Prevention

Always click Allow/Authorize on the provider consent screen; Deny often redirects without a code.
If the callback page shows this message, inspect the URL for `error=access_denied` and restart login.
Never reuse or bookmark callback URLs — codes are one-time.
Verify the OAuth app requests response_type=code.

When it happens

Trigger: The provider redirects to /callback without `?code=...` — e.g. the user denied consent (some providers send `error=access_denied` instead of a code), the redirect URL was edited by hand, or the provider stripped the query string.

Common situations: User clicking 'Cancel'/'Deny' on the consent screen, an OAuth app misconfiguration causing an error redirect, or copy-pasting a truncated URL into the browser.

Related errors

AI-assisted analysis of dubinc/dub@f216b94a24 (2026-08-31). Data as JSON: /api/errors/86b279110dfa1169. Report an issue: GitHub.