larksuite/cli · error

failed to get user info [%d]: %s

Error message

failed to get user info [%d]: %s

What it means

getUserInfo returns 'failed to get user info [%d]: %s' when the /open-apis/authen/v1/user_info endpoint responds with a well-formed envelope whose code field is non-zero, meaning the identity API itself rejected the request. The numeric code and msg come straight from the API response. This is a plain fmt.Errorf, not a typed errs.* API error wrapper per the repository error contract.

Source

Thrown at cmd/auth/auth.go:98

}

// getUserInfo fetches the current user's OpenID and name using the given access token.
func getUserInfo(ctx context.Context, sdk *lark.Client, accessToken string) (openId, name string, err error) {
	apiResp, err := sdk.Do(ctx, &larkcore.ApiReq{
		HttpMethod:                http.MethodGet,
		ApiPath:                   larkauth.PathUserInfoV1,
		SupportedAccessTokenTypes: []larkcore.AccessTokenType{larkcore.AccessTokenTypeUser},
	}, larkcore.WithUserAccessToken(accessToken))
	if err != nil {
		return "", "", err
	}

	var resp userInfoResponse
	if err := json.Unmarshal(apiResp.RawBody, &resp); err != nil {
		return "", "", fmt.Errorf("failed to parse user info: %w", err)
	}
	if resp.Code != 0 {
		return "", "", fmt.Errorf("failed to get user info [%d]: %s", resp.Code, resp.Msg)
	}
	if resp.Data.OpenID == "" {
		return "", "", fmt.Errorf("failed to get user info: missing open_id in response")
	}

	name = resp.Data.Name
	if name == "" {
		name = "(unknown)"
	}
	return resp.Data.OpenID, name, nil
}

// appInfo contains application information (owner, scopes).
type appInfo struct {
	OwnerOpenId string
	UserScopes  []string
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Read the bracketed code and msg in the error, then look it up in Lark's API error code documentation to identify the exact cause.
2. Rerun `lark-cli auth login` to obtain a fresh user access token; expired tokens are the most common cause.
3. Verify the app has the necessary authen/user_info scopes granted in the developer console.
4. Check app_id/app_secret configuration for the active profile; misconfiguration surfaces as API-side rejection codes.

openID, name, err := getUserInfo(ctx, client, token)
if err != nil {
    var apiErr *larkcore.ApiError // or inspect the bracketed code in the message
    // match 'failed to get user info [code]: msg' and route on code
    if strings.Contains(err.Error(), "failed to get user info [99991") {
        return fmt.Errorf("user token invalid or expired; run 'lark-cli auth login' again: %w", err)
    }
    return err
}

When it happens

Trigger: Any non-zero code from user_info: most commonly invalid/expired user_access_token (e.g. code 99991663/99991661-style token errors), insufficient scope for authen user_info, or app-configuration problems; raised during `auth login` flows (authLoginRun, authLoginPollDeviceCode) right after obtaining the token.

Common situations: User access token expired between token exchange and user_info call; the app lacks the required authen scopes; wrong tenant/app credentials configured; token type mismatch (using tenant token where user token is required).

Related errors

• failed to get user info: missing open_id in response
• [%d] %s
• failed to verify user identity: %w
• user_info API returned HTTP %d
• user_info API error: [%d] %s

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/e5b3d1f91f58afae. Report an issue: GitHub.