google-gemini/gemini-cli · info · FatalCancellationError

Authentication cancelled by user.

Error message

Authentication cancelled by user.

What it means

Thrown as a FatalCancellationError when getConsentForOauth('') returns a falsy value, meaning the user explicitly declined the OAuth consent prompt. This is a user-initiated cancellation, not a system error. It only fires when not in ACP mode and when browser launch is not suppressed (the interactive OAuth branch). The error allows the calling code to cleanly abort the auth flow rather than proceeding with incomplete credentials.

Source

Thrown at packages/core/src/code_assist/oauth2.ts:319

    }

    // Retrieve and cache Google Account ID after successful user code auth
    try {
      await fetchAndCacheUserInfo(client);
    } catch (error) {
      debugLogger.warn(
        'Failed to retrieve Google Account ID during authentication:',
        getErrorMessage(error),
      );
    }

    await triggerPostAuthCallbacks(client.credentials);
  } else {
    // In ACP mode, we skip the interactive consent and directly open the browser
    if (!config.getAcpMode()) {
      const userConsent = await getConsentForOauth('');
      if (!userConsent) {
        throw new FatalCancellationError('Authentication cancelled by user.');
      }
    }

    const webLogin = await authWithWeb(client);

    coreEvents.emit(CoreEvent.UserFeedback, {
      severity: 'info',
      message:
        `\n\nAttempting to open authentication page in your browser.\n` +
        `Otherwise navigate to:\n\n${webLogin.authUrl}\n\n\n`,
    });
    try {
      // Attempt to open the authentication URL in the default browser.
      // We do not use the `wait` option here because the main script's execution
      // is already paused by `loginCompletePromise`, which awaits the server callback.
      const childProcess = await open(webLogin.authUrl);

      // IMPORTANT: Attach an error handler to the returned child process.

View on GitHub (pinned to 5024443c72)

Solutions

1. This is an expected user action — re-run the CLI and choose to authenticate when prompted.
2. If using a non-interactive workflow, set GEMINI_API_KEY or use ADC to avoid the consent prompt entirely.
3. Catch FatalCancellationError specifically in automation to exit gracefully with a clear message rather than a stack trace.

Example fix

// Catching cancellation in calling code
try {
  await authenticate(config);
} catch (e) {
  if (e instanceof FatalCancellationError) {
    console.log('Authentication cancelled. Re-run to try again.');
    process.exit(0);
  }
  throw e;
}

try {
  await getOauthClient(authType, config);
} catch (e) {
  if (e instanceof FatalCancellationError) {
    console.log('Authentication cancelled by user. Re-run to authenticate.');
    process.exit(0);
  }
  throw e;
}

When it happens

Trigger: In the interactive OAuth branch (browser not suppressed, not ACP mode), getConsentForOauth('') is called to ask the user for permission to start OAuth. If the user responds 'no' or cancels the prompt, it returns false and this error throws.

Common situations: User selects 'no' or 'cancel' at the OAuth consent prompt; the consent dialog times out; a programmatic caller sends a negative response; the user changes their mind about authenticating with Google.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Manual authorization is required but the current session is
• Failed to authenticate with user code.
• Failed to open browser: ${getErrorMessage(err)}
• ${originalMessage}. The initial COMPUTE_ADC attempt also fai
• COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallba

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/434b8b078df233c3. Report an issue: GitHub.