eyaltoledano/claude-task-master · error · AuthenticationError

OAUTH_FAILED

OAUTH_FAILED

Error message

data.error_description || data.error || 'Authentication failed'

What it means

OAUTH_FAILED is thrown when the polled flow status is 'failed', meaning the OAuth provider itself rejected the authentication (e.g. access_denied, invalid scope). The error message is the provider's error_description or error code forwarded by the backend.

Source

Thrown at packages/tm-core/src/modules/auth/services/oauth-service.ts:391

						);

						this.logger.debug('Successfully decrypted authentication tokens');

						return {
							token: tokens.access_token,
							refreshToken: tokens.refresh_token,
							userId: tokens.user_id,
							email: tokens.email,
							expiresAt: tokens.expires_in
								? new Date(Date.now() + tokens.expires_in * 1000).toISOString()
								: undefined,
							tokenType: 'standard',
							savedAt: new Date().toISOString()
						};
					}

					case 'failed':
						throw new AuthenticationError(
							data.error_description || data.error || 'Authentication failed',
							'OAUTH_FAILED'
						);

					case 'expired':
						throw new AuthenticationError(
							'Authentication flow expired',
							'AUTH_TIMEOUT'
						);

					case 'pending':
					case 'authenticating':
						// Still waiting, continue polling
						this.logger.debug(
							`Flow status: ${data.status}, continuing to poll`
						);
						break;

View on GitHub (pinned to c0c98d367c)

Solutions

1. Read the forwarded error_description to identify the provider error (e.g. access_denied = user cancelled) and retry `credentials()`, completing the browser login and approving access.
2. If access_denied repeats, check org/SSO policies or use an account with access to the application.
3. Verify the OAuth app configuration on the backend (redirect URIs, enabled client, scopes).
4. If errors like invalid_client/invalid_scope appear, the backend OAuth app settings changed — contact the service admin or update the CLI.

Example fix

// before: treats all failures the same
const creds = await oauthService.credentials();
// after: distinguish user-cancellation from real failure
try {
  const creds = await oauthService.credentials();
} catch (e) {
  if (e instanceof AuthenticationError && e.code === 'OAUTH_FAILED') {
    if (/access_denied|cancelled/i.test(e.message)) {
      console.log('Login cancelled; please approve access in the browser.');
    }
    throw e;
  }
  throw e;
}

// confirm the user has access to the org/app before starting the flow
// e.g. check provider account / SSO entitlement via an unauthenticated endpoint
const ent = await fetch(`${baseUrl}/api/auth/cli/config`).then(r => r.ok);

function isOAuthFailed(e: unknown): e is AuthenticationError {
  return e instanceof AuthenticationError && e.code === 'OAUTH_FAILED';
}

try {
  const creds = await oauthService.credentials();
} catch (e) {
  if (e instanceof AuthenticationError && e.code === 'OAUTH_FAILED') {
    // surface the provider's error_description to the user
    console.error(`Login rejected by provider: ${e.message}`);
    if (/access_denied/i.test(e.message)) console.error('You must approve access in the browser to continue.');
    throw e;
  }
  throw e;
}

When it happens

Trigger: During `credentials()`, the status endpoint returns `{success:true,status:'failed',error/error_description:...}` after the user completes (or aborts) the browser login — e.g. the user denied consent, the provider returned an OAuth error, or SSO config rejected the login.

Common situations: User clicks 'Deny'/'Cancel' on the provider consent screen; OAuth app misconfiguration (wrong redirect URI, disabled client); expired or revoked provider client credentials; org policy blocking the account; expired authorization grant server-side.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• FLOW_NOT_FOUND
• AUTH_TIMEOUT
• MFA_REQUIRED_INCOMPLETE
• MFA_REQUIRED
• MFA_VERIFICATION_FAILED

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/8697495d4e3065fc. Report an issue: GitHub.