router-for-me/CLIProxyAPI · error

failed to generate code verifier: %w

Error message

failed to generate code verifier: %w

What it means

GeneratePKCECodes could not produce a code verifier, wrapping the failure from generateCodeVerifier (crypto/rand read failure). This runs at the very start of every Codex login, so it aborts the flow before any browser interaction. In practice the only realistic cause is the wrapped random-bytes error (213) — entropy or rand.Reader unavailability.

Source

Thrown at internal/auth/codex/pkce.go:21

// code generation for secure authentication flows.
package codex

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
)

// GeneratePKCECodes generates a new pair of PKCE (Proof Key for Code Exchange) codes.
// It creates a cryptographically random code verifier and its corresponding
// SHA256 code challenge, as specified in RFC 7636. This is a critical security
// feature for the OAuth 2.0 authorization code flow.
func GeneratePKCECodes() (*PKCECodes, error) {
	// Generate code verifier: 43-128 characters, URL-safe
	codeVerifier, err := generateCodeVerifier()
	if err != nil {
		return nil, fmt.Errorf("failed to generate code verifier: %w", err)
	}

	// Generate code challenge using S256 method
	codeChallenge := generateCodeChallenge(codeVerifier)

	return &PKCECodes{
		CodeVerifier:  codeVerifier,
		CodeChallenge: codeChallenge,
	}, nil
}

// generateCodeVerifier creates a cryptographically secure random string to be used
// as the code verifier in the PKCE flow. The verifier is a high-entropy string
// that is later used to prove possession of the client that initiated the
// authorization request.
func generateCodeVerifier() (string, error) {
	// Generate 96 random bytes (will result in 128 base64 characters)
	bytes := make([]byte, 96)

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Treat it as an environment problem: verify /dev/urandom (or getrandom) is available inside the container.
2. Remove any test stubs overriding rand.Reader.
3. If the runtime genuinely lacks entropy early at boot, retry login after the system has run for a moment.
4. As a last resort on broken hosts, upgrade the kernel/runtime.

codes, err := pkce.GeneratePKCECodes()
if err != nil {
    // crypto/entropy problem: environment-level fix required (see rand.Read)
    log.Errorf("cannot generate PKCE (rand unavailable?): %v", err)
    return err
}

When it happens

Trigger: rand.Read returning an error (see 213); a test or embedder replacing rand.Reader with a failing reader; extremely constrained container runtimes without getrandom(2).

Common situations: Exotic minimal containers/VMs lacking entropy sources; custom builds that stub out crypto/rand; essentially never on mainstream Linux/macOS.

Related errors

• token exchange failed with status %d: %s
• failed to generate code verifier: %w
• port %d is already in use
• timeout waiting for OAuth callback
• failed to create token request: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/4cf5bf8813ed58f3. Report an issue: GitHub.