multica-ai/multica · error

composio: callback missing connected_account_id

Error message

composio: callback missing connected_account_id

What it means

Error "composio: callback missing connected_account_id" thrown in multica-ai/multica.

Source

Thrown at server/internal/integrations/composio/service.go:299

// CompleteCallback verifies the signed state and, on a successful Composio
// status, upserts the local connection row. It returns the toolkit slug from
// the state so the handler can build the right redirect even on the
// not-successful path.
//
// Idempotency: the upsert is keyed on (user_id, connected_account_id), so a
// duplicate callback re-activates the same row instead of creating a second.
func (s *Service) CompleteCallback(ctx context.Context, state, status, connectedAccountID string) (string, error) {
	claims, err := verifyState(s.secret, state, s.now())
	if err != nil {
		return "", err
	}

	if !strings.EqualFold(strings.TrimSpace(status), "success") {
		// Honor the state for the redirect slug, but do not write an active row.
		return claims.ToolkitSlug, ErrConnectNotSuccessful
	}
	if strings.TrimSpace(connectedAccountID) == "" {
		return claims.ToolkitSlug, errors.New("composio: callback missing connected_account_id")
	}

	userID, err := util.ParseUUID(claims.UserID)
	if err != nil {
		return claims.ToolkitSlug, fmt.Errorf("composio: state has invalid user id: %w", err)
	}

	// The auth_config_id was resolved at BeginConnect and signed into the state,
	// so we compare against THAT exact value rather than re-resolving here (a
	// re-resolve that failed or drifted would otherwise fail-open: a missing
	// expected auth config used to skip the check, letting another toolkit's
	// account id be bound under this toolkit's slug). An empty value fails
	// closed in verifyAccountOwnership.
	authConfigID := claims.AuthConfigID

	// Defense-in-depth (PR 4608 review): the signed state proves *who* started
	// the handshake and *which* toolkit, but connected_account_id rides back as
	// a plain query param Composio appends to our callback URL. A crafted

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Restart the Composio OAuth flow; the callback was missing the connected_account_id parameter.

When it happens

Trigger: Thrown at server/internal/integrations/composio/service.go:299 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/fc60a6241ef357d7. Report an issue: GitHub.