jackwener/OpenCLI · error · AuthRequiredError

creator.douyin.com

Error message

creator.douyin.com

What it means

getSts2Credentials fetches temporary STS2 storage credentials from creator.douyin.com and throws AuthRequiredError when the response contains no access_key_id. The thrown message is just the host because AuthRequiredError keys on the site whose authentication is required. Without valid STS2 credentials, subsequent storage/upload operations cannot be signed.

Source

Thrown at clis/douyin/_shared/sts2.js:18

import { AuthRequiredError } from '@jackwener/opencli/errors';
const STS2_URL = 'https://creator.douyin.com/aweme/mid/video/sts2/?scene=web&aid=1128&cookie_enabled=true&device_platform=web';
/**
 * Fetch STS2 temporary credentials from the creator center.
 * These are used to authenticate Node.js-side TOS multipart uploads.
 * Returns: { access_key_id, secret_access_key, session_token, expired_time }
 */
export async function getSts2Credentials(page) {
    const js = `fetch(${JSON.stringify(STS2_URL)}, { credentials: 'include' }).then(r => r.json())`;
    const res = await page.evaluate(js);
    const credentials = (typeof res === 'object' &&
        res !== null &&
        'data' in res &&
        res.data)
        ? res.data
        : res;
    if (!credentials?.access_key_id) {
        throw new AuthRequiredError('creator.douyin.com', 'STS2 credentials missing');
    }
    return credentials;
}

View on GitHub (pinned to 49907e53dc)

Solutions

1. Re-authenticate on creator.douyin.com (fresh login/cookies) and retry the credential fetch.
2. Log the raw STS2 response to check whether the shape changed (credentials nested differently).
3. Complete any captcha/risk-control challenge, then re-fetch credentials.
4. Ensure the STS2 endpoint URL is current if Douyin changed its internal API.

Example fix

// before: assuming credentials always present
const sts = await getSts2Credentials(page);
uploadWith(sts.access_key_id);
// after
let sts;
try {
  sts = await getSts2Credentials(page);
} catch (e) {
  if (e instanceof AuthRequiredError) await reloginCreatorDouyin();
  sts = await getSts2Credentials(page);
}

null

function hasSts2Creds(v: unknown): v is { access_key_id: string } & Record<string, unknown> {
  return typeof v === 'object' && v !== null && 'access_key_id' in v && Boolean((v as any).access_key_id);
}

import { AuthRequiredError } from './_shared/errors.js';
try {
  const sts = await getSts2Credentials(page);
} catch (e) {
  if (e instanceof AuthRequiredError) {
    await relogin('creator.douyin.com');
    return getSts2Credentials(page);
  }
  throw e;
}

When it happens

Trigger: The STS2 credential API returns an empty/unshaped payload (res or res.data missing access_key_id) — typically when the browser session is logged out or the credential endpoint rejects the request.

Common situations: Expired creator.douyin.com session; risk-control interstitial returning an empty body; API shape change moving credentials elsewhere in the response; calling credentials fetch before completing login.

Related errors

• Douyin API auth/permission error ${code} at ${method} ${url}
• TOS init multipart upload failed with status ${res.status}:
• 获取抖音上传授权失败: ${JSON.stringify(result)}
• 获取抖音上传授权失败: ${message}
• 抖音上传授权缺少 AccessKeyID/SecretAccessKey/SessionToken

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/df45321f049c27e5. Report an issue: GitHub.