github getAccessToken: POST url %v received error from githu

Error message

github getAccessToken: POST url %v received error from github, err: %v

What it means

githubAppClient.getAccessToken exchanges an OAuth code for a token via postToGithub and wraps any transport/HTTP-level failure with the exact URL posted to. The underlying postToGithub error may be a network failure, a non-2xx status, or a rejected POST (bad client_id/client_secret, expired or reused code, redirect mismatch).

Source

Thrown at pkg/auth/providers/githubapp/githubapp_client.go:46

	maxGitHubBodySize int64 = 1024 * 1024 * 5
)

// githubAppClient implements client for GitHub using a GitHub App.
type githubAppClient struct {
	httpClient *http.Client
}

func (g *githubAppClient) getAccessToken(ctx context.Context, code string, config *apiv3.GithubAppConfig) (string, error) {
	form := url.Values{}
	form.Add("client_id", config.ClientID)
	form.Add("client_secret", config.ClientSecret)
	form.Add("code", code)

	url := getAPIURL("TOKEN", config)

	b, err := g.postToGithub(ctx, url, form)
	if err != nil {
		return "", fmt.Errorf("github getAccessToken: POST url %v received error from github, err: %v", url, err)
	}

	// Decode the response
	var respMap map[string]any

	if err := json.Unmarshal(b, &respMap); err != nil {
		return "", fmt.Errorf("github getAccessToken: received error unmarshalling response body, err: %v", err)
	}

	if respMap["error"] != nil {
		desc := respMap["error_description"]
		return "", fmt.Errorf("github getAccessToken: received error from github %v, description from github %v", respMap["error"], desc)
	}

	acessToken, ok := respMap["access_token"].(string)
	if !ok {
		return "", fmt.Errorf("github getAccessToken: received error reading accessToken from response %v", respMap)
	}

View on GitHub (pinned to 932558d4e6)

Solutions

If the error contains a 401/400 status: verify ClientID/ClientSecret in the GithubAppConfig secret exactly match the GitHub App.
If the code is reused/expired: have the user restart the login from the auth page instead of refreshing the callback URL.
Confirm the app's callback/redirect URL registered on GitHub matches the RedirectURL the provider sends.
For GHE, verify the endpoint URL and network path (curl the TOKEN endpoint from inside the pod).

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-flight the OAuth exchange inputs
if config.ClientID == "" || config.ClientSecret == "" {
    return errors.New("github app client id/secret missing in GithubAppConfig")
}
if code == "" {
    return errors.New("empty OAuth code — restart login instead of reusing the callback")
}

Try / catch

b, err := g.postToGithub(ctx, url, form)
if err != nil {
    // OAuth codes are single-use: retrying the same form fails again.
    // Network/5xx causes are retryable only with a freshly issued code.
    return "", fmt.Errorf("github getAccessToken: POST url %v received error from github, err: %v", url, err)
}

Prevention

Never re-render or refresh the OAuth callback URL — always restart from the login page.
Keep ClientID/ClientSecret synced with the GitHub App settings (rotate together).
Register the exact callback URL on the GitHub App and verify redirects match.
curl the token endpoint from the pod to rule out egress/proxy issues when debugging.

When it happens

Trigger: POST to the configured TOKEN endpoint (github.com/login/oauth/access_token or GHE equivalent) with wrong ClientSecret in GithubAppConfig; the device-flow/user code already redeemed or expired (codes are single-use, ~10 min TTL); redirect_uri not matching the app settings; GitHub unreachable or a GHE endpoint typo.

Common situations: Browser back-button or refresh re-submitting the callback with the same code; clock-sensitive logins during NTP drift; client secret rotated on GitHub but stale in the Rancher secret; GHE URL missing scheme.

Related errors

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/91de588633cb48ea. Report an issue: GitHub.