jackwener/OpenCLI · error · AuthRequiredError

Xiaohongshu creator profile requires login: ${detail}

Error message

Xiaohongshu creator profile requires login: ${detail}

What it means

verifyXhsIdentity evaluates a fetch of the creator.xiaohongshu.com personal_info API in the page; if the request does not succeed (ok falsy), it throws AuthRequiredError for creator.xiaohongshu.com including the API's msg, a response preview, or the HTTP status. It means XHS does not consider the browser session logged in as a creator.

Source

Thrown at clis/xiaohongshu/auth.js:28

async function verifyXhsIdentity(page) {
  await page.goto('https://creator.xiaohongshu.com/new/home');
  const payload = await page.evaluate(`
    async () => {
      try {
        const resp = await fetch('/api/galaxy/creator/home/personal_info', { credentials: 'include' });
        const text = await resp.text();
        let parsed = null;
        try { parsed = JSON.parse(text); } catch {}
        return [resp.ok, resp.status, parsed, text.slice(0, 200)];
      } catch (error) {
        return [false, 0, null, String(error && error.message || error)];
      }
    }
  `);
  const [ok, status, parsed, preview] = Array.isArray(payload) ? payload : [];
  if (!ok) {
    const detail = parsed?.msg ?? preview ?? `HTTP ${status ?? ''}`;
    throw new AuthRequiredError('creator.xiaohongshu.com', `Xiaohongshu creator profile requires login: ${detail}`);
  }
  const data = parsed?.data;
  if (!data) {
    throw new CommandExecutionError('Xiaohongshu creator profile returned malformed personal_info payload');
  }
  return {
    username: data.name ?? '',
    followers: data.fans_count ?? 0,
  };
}

registerSiteAuthCommands({
  site: 'xiaohongshu',
  domain: 'creator.xiaohongshu.com',
  loginUrl: 'https://creator.xiaohongshu.com/',
  columns: ['username', 'followers'],
  quickCheck: hasXhsSessionCookies,
  verify: verifyXhsIdentity,

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Run the login flow for creator.xiaohongshu.com and complete any security verification.
  2. Log in manually in the controlled browser to confirm creator access works.
  3. Check the detail suffix (msg/HTTP status) for the precise rejection reason.
  4. Clear stale cookies for the xiaohongshu.com domain and log in fresh.
  5. Retry later if XHS imposed a temporary risk-control block.

Example fix

// before
const identity = await verifyXhsIdentity(page); // throws if not logged in
// after
if (!await hasXhsSessionCookies(page)) {
  await runLogin('creator.xiaohongshu.com');
}
const identity = await verifyXhsIdentity(page);
Defensive patterns

Strategy: try-catch

Validate before calling

// verify creator session before identity checks
const hasCookies = await hasXhsSessionCookies(page);
if (!hasCookies) await runLogin('creator.xiaohongshu.com');

Try / catch

try {
  const identity = await verifyXhsIdentity(page);
  return identity;
} catch (e) {
  if (e instanceof AuthRequiredError || /requires login/.test(e.message)) {
    await runLogin('creator.xiaohongshu.com');
    return verifyXhsIdentity(page);
  }
  throw e;
}

Prevention

When it happens

Trigger: payload[0] (ok) is false because the personal_info endpoint returned a non-success response — e.g. an auth redirect, an error body with msg like '未登录', or a non-2xx status.

Common situations: Creator-session cookies expired; user logged into www.xiaohongshu.com but not creator.xiaohongshu.com; XHS invalidated the session (password change, security check); hitting the endpoint from a flagged IP/datacenter.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/6fa053ad60814d6e. Report an issue: GitHub.