jackwener/OpenCLI · error · AuthRequiredError

LinkedIn messengerMessages API authentication failed: ${fetc

Error message

LinkedIn messengerMessages API authentication failed: ${fetched.error}

What it means

After discovering the thread's messengerMessages API URLs, thread-snapshot fetches them in-page with the session CSRF token. If the fetch reports authRequired — LinkedIn returned a login wall or 401/403-style error — the command throws AuthRequiredError, meaning the browser session is no longer signed in for API calls.

Source

Thrown at clis/linkedin/thread-snapshot.js:356

    if (!discovery || typeof discovery !== 'object' || Array.isArray(discovery) || !Array.isArray(discovery.apiUrls)) {
      throw new CommandExecutionError('LinkedIn thread-snapshot returned a malformed API discovery payload.');
    }

    const actualUrl = canonicalizeLinkedInThreadUrl(discovery.url || '');
    if (threadUrl && actualUrl && threadUrl !== actualUrl) {
      throw new CommandExecutionError('LinkedIn thread-snapshot blocked: thread_url_mismatch', `Expected ${threadUrl}; actual ${actualUrl}`);
    }
    if (maxScrolls >= 4 && discovery.scrollAttempts >= maxScrolls && discovery.scrollStable === false) {
      throw new CommandExecutionError('LinkedIn thread history did not stabilize before --max-scrolls; refusing to return a partial snapshot.');
    }

    const apiUrls = validateThreadApiUrls(discovery.apiUrls, threadUrl);
    const csrf = await requireLinkedInCookie(page, 'LinkedIn thread-snapshot');
    const fetched = unwrapEvaluateResult(
      await page.evaluate(buildFetchThreadPagesScript(apiUrls, csrf)),
    );
    if (fetched?.authRequired) {
      throw new AuthRequiredError(LINKEDIN_DOMAIN, `LinkedIn messengerMessages API authentication failed: ${fetched.error}`);
    }
    if (!fetched || fetched.error || !Array.isArray(fetched.pages)) {
      throw new CommandExecutionError(`LinkedIn messengerMessages API returned an unexpected response: ${fetched?.error || 'no data'}`);
    }

    const parsed = parseThreadPages(fetched.pages);
    const recipient = parsed.recipientNames.join(', ');
    const latestMessageText = parsed.messages[parsed.messages.length - 1]?.text || '';
    const normalized = {
      url: actualUrl || threadUrl,
      title: normalizeWhitespace(discovery.title),
      headerNames: parsed.recipientNames,
      latestMessageText,
      messages: parsed.messages,
      messageCount: parsed.messages.length,
      authRequired: false,
      extractedAt: new Date().toISOString(),
      maxScrolls,

View on GitHub (pinned to 49907e53dc)

Solutions

Re-authenticate in the linked browser: run the site auth/login flow for linkedin.com and retry
Verify the LinkedIn home feed renders as signed-in before re-running thread-snapshot
Clear stale LinkedIn cookies and log in fresh if the session is in a half-valid state
Check for a security challenge/verification email from LinkedIn blocking the session

Defensive patterns

Strategy: try-catch

Validate before calling

const cookies = await page.getCookies({ url: 'https://www.linkedin.com' });
const signedIn = cookies.some(c => c.name === 'li_at' && c.value);
if (!signedIn) throw new Error('Run the LinkedIn login flow first');

Type guard

const hasLinkedInSession = (cookies) => Array.isArray(cookies) && cookies.some(c => c.name === 'li_at' && c.value);

Try / catch

try {
  await threadSnapshot({ threadUrl });
} catch (e) {
  if (e.name === 'AuthRequiredError' || String(e.message).includes('authentication failed')) {
    await linkedinLogin(); // re-authenticate then retry
  } else throw e;
}

Prevention

Use a persistent browser profile so li_at survives restarts
Re-login before long automation runs
Watch for LinkedIn security-challenge emails
Avoid logging into LinkedIn from many devices simultaneously

When it happens

Trigger: The signed-in session cookie/CSRF token expired between page load and the API fetch; LinkedIn invalidated the session (logged out elsewhere, security challenge); fetch to messengerMessages returns a redirect to the login page.

Common situations: Long-running browser sessions where LinkedIn expires the session; logging into LinkedIn from another device; triggering LinkedIn's bot/security challenge; corporate network proxying interfering with session cookies.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/3572c2e23f938900. Report an issue: GitHub.