What causes "www.youtube.com" in jackwener/OpenCLI?

Re-login to www.youtube.com in the automation browser profile to refresh the Google session, then retry.

jackwener/OpenCLI · critical · AuthRequiredError

www.youtube.com

Error message

www.youtube.com

What it means

AuthRequiredError re-thrown after the in-page YouTube API call reports error === 'auth'. The page-side evaluate detected that YouTube's endpoint rejected the request as unauthenticated (typically a 401/login-required response from the like/unlike internal API), so the library converts it into AuthRequiredError for www.youtube.com. Unlike 5050, the SAPISID cookie existed but the session was still deemed unauthenticated.

Source

Thrown at clis/youtube/unlike.js:60

            'Content-Type': 'application/json',
            'Authorization': authHash,
            'X-Origin': 'https://www.youtube.com',
          },
          body: JSON.stringify({ context, target: { videoId: ${JSON.stringify(videoId)} } }),
        });

        if (resp.status === 401 || resp.status === 403) return { error: 'auth', message: 'Not logged in' };
        if (!resp.ok) {
          const body = await resp.json().catch(() => ({}));
          const errStatus = body?.error?.status || '';
          if (errStatus === 'UNAUTHENTICATED') return { error: 'auth', message: 'Not logged in' };
          return { error: 'http', message: 'HTTP ' + resp.status + (errStatus ? ' ' + errStatus : '') };
        }
        return { ok: true };
      })()
    `);
        if (result?.error === 'auth') {
            throw new AuthRequiredError('www.youtube.com');
        }
        if (result?.error) {
            throw new CommandExecutionError(result.message || 'Failed to remove like');
        }
        return [{ status: 'success', message: 'Unliked: ' + videoId }];
    },
});

View on GitHub (pinned to 49907e53dc)

Solutions

Re-login to www.youtube.com in the automation browser profile to refresh the Google session, then retry.
Clear and re-establish YouTube cookies (fresh login) so SAPISID matches a valid session.
Check the in-page request includes a correct SAPISIDHASH Authorization header built from the current SAPISID and origin.
Update the library if YouTube changed the internal like/unlike API auth requirements.

Defensive patterns

Strategy: try-catch

Validate before calling

const sapisid = await readYoutubeSapisid(page);
if (!sapisid) throw new Error('YouTube session invalid — re-login required');

Try / catch

try {
  await unlike({ url });
} catch (e) {
  if (e.name === 'AuthRequiredError') {
    await refreshYoutubeSession(page);
    return unlike({ url });
  }
  throw e;
}

Prevention

Treat a SAPISID cookie as necessary but not sufficient — sessions can be server-side revoked; detect 401/auth errors and re-login.
Refresh Google sessions periodically in long-lived automation profiles.
Keep the SAPISIDHASH header construction in sync with the current SAPISID and origin.
Watch for account security events (password changes) that invalidate cookies.

When it happens

Trigger: The page.evaluate payload returns { error: 'auth' } — e.g. YouTube's /youtubei/v1/like/removelike endpoint responds 401 or an auth-required status even though a SAPISID cookie was present.

Common situations: Stale/expired session cookies that still contain SAPISID but fail server-side validation; YouTube session revoked (password change, security event); missing or mismatched SAPISIDHASH authorization header due to ytcfg changes; account requires re-verification.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/942116d8b9f48c6c. Report an issue: GitHub.