jdx/mise · error

GitHub OAuth is configured for {}, not {}

Error message

GitHub OAuth is configured for {}, not {}

What it means

token_async validates that the request host matches the host configured via github.oauth_api_url before exchanging tokens. If the caller asked for a token for a different host (e.g. a GHES instance) than the one the OAuth client is registered against, mise refuses with both hosts in the message to prevent sending credentials to the wrong server.

Source

Thrown at src/github/oauth.rs:241

        return Ok(None);
    };
    let access_token = refreshed.access_token.clone();
    cache.tokens.insert(cache_key.to_string(), refreshed);
    if let Err(err) = write_cache_locked_async(cache_lock, cache).await {
        warn!("failed to cache refreshed GitHub OAuth token: {err:#}");
    }
    Ok(Some(access_token))
}

async fn token_async(req: TokenRequest) -> Result<String> {
    let settings = Settings::get();
    let client_id = settings.github.oauth_client_id.trim();
    let scopes = settings.github.oauth_scopes.trim();
    if client_id.is_empty() {
        bail!("GitHub OAuth is not configured. Set github.oauth_client_id first.");
    }
    if !host_matches_settings(&req.host, &settings.github.oauth_api_url) {
        bail!(
            "GitHub OAuth is configured for {}, not {}",
            api_host(&settings.github.oauth_api_url).unwrap_or_else(|| "unknown host".to_string()),
            req.host
        );
    }

    let canonical_host =
        api_host(&settings.github.oauth_api_url).unwrap_or_else(|| req.host.clone());
    let cache_key = cache_key(&canonical_host, client_id, scopes);
    let cache = read_cache_async().await?;
    if !req.force_refresh
        && let Some(cached) = cache.tokens.get(&cache_key)
        && reusable(cached)
    {
        return Ok(cached.access_token.clone());
    }
    if let Some(cached) = cache.tokens.get(&cache_key).cloned() {
        // Passing the cached token as "stale" forces the refresh-token grant

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Align github.oauth_api_url with the host you are authenticating to (set it to your GHES API URL for enterprise, or unset it to use github.com).
2. Remove the stale github.oauth_api_url setting if you actually intend to use github.com.
3. Update the requesting code/backend to ask for a token for the configured host instead of a different one.
4. Register a separate OAuth client on the enterprise instance and configure both oauth_client_id and oauth_api_url together.

Example fix

# before: settings.toml
[github]
oauth_client_id = "Iv1.xxx"
# oauth_api_url defaults to github.com but requests target GHES
// after
[github]
oauth_client_id = "Iv1.yyy"  # client registered on GHES
oauth_api_url = "https://github.enterprise.example.com/api/v3"

// before requesting a token for a host
const settings = await getSettings();
const apiHost = new URL(settings.github?.oauth_api_url ?? 'https://github.com').host;
if (apiHost !== requestHost) throw new Error(`oauth client is bound to ${apiHost}, not ${requestHost}`);

try { const t = await githubToken(host); } catch (e) { if (String(e).includes('GitHub OAuth is configured for')) { console.error('Align github.oauth_api_url with the host being authenticated (GHES vs github.com)'); } else throw e; }

When it happens

Trigger: token()/token_async() invoked with req.host = "github.enterprise.example.com" (or any host) while settings.github.oauth_api_url points at api.github.com (or another host) — the host strings do not match, so the exchange bails.

Common situations: Using a GitHub Enterprise Server URL for repos but leaving github.oauth_api_url at the default github.com; misconfigured oauth_api_url (wrong scheme/path or trailing host mismatch); a backend or plugin requesting tokens for a mirror/fork host; copy-pasted enterprise config without updating the API URL (or vice versa).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• GitHub OAuth is not configured. Set github.oauth_client_id f
• GitHub OAuth token is not cached. Run `mise token github --o
• aqua package {} does not have repo_owner and/or repo_name.
• GitHub device authorization expired
• GitHub device authorization was denied

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/3f6d108c67059c8e. Report an issue: GitHub.