What causes "NotebookLM RPC returned auth error (${response.status})" in jackwener/OpenCLI?

Re-authenticate in the attached Chrome profile and retry the command.

jackwener/OpenCLI · error · AuthRequiredError

NotebookLM RPC returned auth error (${response.status})

Error message

NotebookLM RPC returned auth error (${response.status})

What it means

When the NotebookLM RPC endpoint itself answers 401 or 403, callNotebooklmRpc throws AuthRequiredError for the NOTEBOOKLM_DOMAIN. This is the server explicitly rejecting the request's credentials even though the URL checks passed, distinguishing an auth failure from other non-OK HTTP statuses (which get the generic NOTEBOOKLM_RPC CliError).

Source

Thrown at clis/notebooklm/rpc.js:252

        method: 'POST',
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
        },
        body: requestBody,
    });
    const requestUrl = parseTrustedNotebooklmUrl(response.requestUrl);
    const finalUrl = parseTrustedNotebooklmUrl(response.finalUrl);
    if (!requestUrl || requestUrl.origin !== auth.origin || requestUrl.pathname !== NOTEBOOKLM_RPC_PATH) {
        throw new CommandExecutionError('NotebookLM RPC request resolved outside the active trusted origin');
    }
    if (finalUrl?.origin === auth.origin && (finalUrl.pathname === '/login' || finalUrl.pathname.startsWith('/login/'))) {
        throw new AuthRequiredError(NOTEBOOKLM_DOMAIN, 'NotebookLM RPC redirected to the login page');
    }
    if (!finalUrl || finalUrl.origin !== auth.origin || finalUrl.pathname !== NOTEBOOKLM_RPC_PATH) {
        throw new CommandExecutionError('NotebookLM RPC response redirected outside the active trusted endpoint');
    }
    if (response.status === 401 || response.status === 403) {
        throw new AuthRequiredError(NOTEBOOKLM_DOMAIN, `NotebookLM RPC returned auth error (${response.status})`);
    }
    if (!response.ok) {
        throw new CliError('NOTEBOOKLM_RPC', `NotebookLM RPC request failed with HTTP ${response.status}`, 'Retry from the NotebookLM home page in an already logged-in Chrome session.');
    }
    return {
        auth,
        url: requestUrl.href,
        requestBody,
        response,
        result: extractNotebooklmRpcResult(response.body, rpcId),
    };
}

View on GitHub (pinned to 49907e53dc)

Solutions

Re-authenticate in the attached Chrome profile and retry the command.
Verify the logged-in Google account actually has access to the notebook (open it in the browser UI first).
Wait and retry with backoff if 403 is caused by rate limiting / anti-abuse detection.
If the notebook is workspace-restricted, request access or use an account within the allowed domain.

Example fix

// before
const rows = await listNotebooklmSourcesViaRpc(page);
// after
try {
  const rows = await listNotebooklmSourcesViaRpc(page);
} catch (e) {
  if (e instanceof AuthRequiredError) await promptNotebooklmLogin();
  else throw e;
}

Defensive patterns

Strategy: try-catch

Validate before calling

// verify the account can see the notebook in the UI before RPC calls
const state = await getNotebooklmPageState(page);
if (state.kind !== 'notebook') throw new Error('Open the notebook in the attached browser and confirm access first.');

Try / catch

try {
  const res = await callNotebooklmRpc(page, auth, method, body);
} catch (e) {
  if (e instanceof AuthRequiredError && /auth error \((401|403)\)/.test(e.message)) {
    if (e.message.includes('403')) await verifyNotebookAccess(page); // account lacks permission
    else await reauthenticateNotebooklm(page); // 401: re-login
  } else throw e;
}

Prevention

Open the notebook manually in the attached profile to confirm account access before scripting.
Use a Chrome profile whose Google account owns or is shared on the target notebook.
Throttle RPC request rates to avoid 403 anti-abuse rejections.
Route 401 vs 403 to different recovery paths (re-login vs access request).

When it happens

Trigger: response.status === 401 (unauthenticated / expired auth cookies) or 403 (authenticated but forbidden — wrong account, no access to the notebook, or anti-abuse rejection) returned by the batchexecute endpoint.

Common situations: Cookie expiry without a login redirect; the attached Chrome profile's Google account lacks access to the target notebook; Google rate-limiting or flagging automated requests; workspace policies blocking NotebookLM API access.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/4619e45d4f83632f. Report an issue: GitHub.