jackwener/OpenCLI · error

Could not extract CSRF token from barchart.com. Make sure yo

Error message

Could not extract CSRF token from barchart.com. Make sure you are logged in.

What it means

The barchart flow command inspects the result of an in-browser evaluation that extracts Barchart's CSRF token. When the script reports error:'no-csrf', the CLI throws this Error because subsequent authenticated requests need that token. It is thrown when the token cannot be found in the page, almost always because the browser session is not logged in to barchart.com.

Source

Thrown at clis/barchart/flow.js:100

                strike: r.strikePrice,
                expiration: r.expirationDate,
                last: r.lastPrice,
                volume: r.volume,
                openInterest: r.openInterest,
                volOiRatio: r.volumeOpenInterestRatio,
                iv: r.volatility,
              };
            });
          } catch(e) {}
        }

        return [];
      })()
    `);
        if (!data)
            return [];
        if (data.error === 'no-csrf') {
            throw new Error('Could not extract CSRF token from barchart.com. Make sure you are logged in.');
        }
        if (!Array.isArray(data))
            return [];
        return data.slice(0, limit).map(r => ({
            symbol: r.symbol || '',
            type: r.type || '',
            strike: r.strike,
            expiration: r.expiration ?? null,
            last: r.last != null ? Number(Number(r.last).toFixed(2)) : null,
            volume: r.volume,
            openInterest: r.openInterest,
            volOiRatio: r.volOiRatio != null ? Number(Number(r.volOiRatio).toFixed(2)) : null,
            iv: r.iv != null ? Number(Number(r.iv).toFixed(2)) + '%' : null,
        }));
    },
});

View on GitHub (pinned to 49907e53dc)

Solutions

1. Log in to barchart.com in the browser profile/session the CLI uses, then rerun the command.
2. Refresh expired Barchart session cookies or re-run the CLI's login/auth flow.
3. Open the target page manually to check whether Barchart is showing a login/consent interstitial and complete it.
4. If you are logged in and it still fails, inspect whether Barchart's markup changed and update the CSRF extraction logic.

Example fix

// before
const data = await browserEval(script); // assumes logged in
// after
const data = await browserEval(script);
if (data && data.error === 'no-csrf') {
  throw new Error('Not logged in to barchart.com — run the login flow first');
}

// Verify a logged-in Barchart session before running commands that need CSRF
const res = await fetch('https://www.barchart.com/my/summary', { headers: { cookie: cookies } });
if (!res.ok || /sign in/i.test(await res.text())) {
  throw new Error('Barchart session not logged in — run login flow first');
}

function hasCsrf(data) {
  return data !== null && typeof data === 'object' && data.error !== 'no-csrf';
}

try {
  const rows = await barchartFlow(limit);
} catch (e) {
  if (e.message.includes('CSRF token')) {
    await barchartLogin(); // re-authenticate
    return barchartFlow(limit);
  }
  throw e;
}

When it happens

Trigger: Running a barchart command whose page-extraction script returns { error: 'no-csrf' } — i.e., the CSRF token element/variable was absent from the loaded page — while the command still proceeded to attempt an authenticated fetch.

Common situations: Not being logged in to barchart.com in the browser profile the CLI uses; session cookies expired; Barchart changed its page markup so the token extraction selector no longer matches; being redirected to a login or interstitial page instead of the expected page.

Related errors

• 12306 tk auth cookie missing
• Amazon review discussion requires an active signed-in Amazon
• Barchart greeks request failed: HTTP ${data.status}${data.st
• Barchart greeks returned an unreadable options payload${data
• Failed to fetch Barchart greeks for ${symbol}

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/b3c0b62736818a23. Report an issue: GitHub.