larksuite/cli · error

failed to resolve UAT for user identity verification: %w

Error message

failed to resolve UAT for user identity verification: %w

What it means

During account resolution the credential provider tries to obtain a User Access Token (UAT) from the active credential source in order to verify the user's identity (via the user_info endpoint). If the source returns any error other than an explicit extcred.BlockError, the failure is wrapped with this message and propagated from doResolveAccount, aborting account resolution. BlockError is treated as a benign skip; any other resolution failure is fatal.

Source

Thrown at internal/credential/credential_provider.go:235

		return acct, nil
	}
	return nil, core.NotConfiguredError()
}

// enrichUserInfo resolves user identity when extension provides a UAT.
// If UAT is available, user_info API call is mandatory (security: verify token validity).
// If no UAT from extension, falls back to provider-supplied OpenID.
func (p *CredentialProvider) enrichUserInfo(ctx context.Context, acct *Account, source credentialSource) error {
	if p.httpClient == nil || source == nil {
		return nil
	}
	tok, found, err := source.TryResolveToken(ctx, TokenSpec{Type: TokenTypeUAT, AppID: acct.AppID})
	if err != nil {
		var blockErr *extcred.BlockError
		if errors.As(err, &blockErr) {
			return nil // provider explicitly blocks UAT; skip enrichment
		}
		return fmt.Errorf("failed to resolve UAT for user identity verification: %w", err)
	}
	if !found {
		return nil
	}
	// Have UAT — must verify and resolve identity
	hc, err := p.httpClient()
	if err != nil {
		return fmt.Errorf("failed to get HTTP client for user_info: %w", err)
	}
	requestCtx := core.WithCredentialSource(ctx, tok.Source)
	info, err := fetchUserInfo(requestCtx, hc, acct.Brand, tok.Token)
	if err != nil {
		return fmt.Errorf("failed to verify user identity: %w", err)
	}
	acct.UserOpenId = info.OpenID
	acct.UserName = info.Name
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Check the wrapped cause (%w) to identify which credential source failed and fix that backend (start/re-authenticate the extension, unlock the OS keychain)
2. If the extension intentionally should not supply UATs, fix it to return extcred.BlockError so enrichment is skipped instead of failing
3. Remove or re-register the broken credential source, or fall back to a working auth mode (e.g. re-run the auth/login flow) and retry

// Verify the credential source is healthy before account resolution
_, _, err := source.TryResolveToken(ctx, credential.TokenSpec{Type: credential.TokenTypeUAT, AppID: acct.AppID})
if err != nil && !isBlockError(err) {
	return fmt.Errorf("UAT source unhealthy: %w", err)
}

func isBlockError(err error) bool {
	var be *extcred.BlockError
	return errors.As(err, &be)
}

if err := provider.ResolveAccount(ctx); err != nil {
	var blockErr *extcred.BlockError
	if errors.As(err, &blockErr) {
		// source intentionally blocks UAT — proceed without user identity
	} else {
		return fmt.Errorf("cannot resolve account: %w", err)
	}
}

When it happens

Trigger: source.TryResolveToken(ctx, TokenSpec{Type: TokenTypeUAT, AppID: ...}) returns a non-nil error that is not *extcred.BlockError — e.g. the extension credential source fails to load, keychain/OS credential store access fails, or the source implementation itself errors while looking up the UAT.

Common situations: A credential extension/plugin is misconfigured or crashing; OS keychain locked or inaccessible (Linux without a secret service, SSH session without keyring); stale extension registration pointing at a removed backend.

Related errors

• failed to verify user identity: %w
• stored token data is corrupt
• failed to parse user info: %w
• failed to get user info [%d]: %s
• failed to get user info: missing open_id in response

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/fbec5636b2e5ee4b. Report an issue: GitHub.