router-for-me/CLIProxyAPI · error

No authorization code received

Error message

No authorization code received

What it means

The Codex OAuth callback request contained neither error nor code query parameters, so no authorization code exists to exchange for tokens. The handler sends OAuthResult{Error: "no_code"} and returns HTTP 400 "No authorization code received".

Source

Thrown at internal/auth/codex/oauth_server.go:197

	// Validate required parameters
	if errorParam != "" {
		log.Errorf("OAuth error received: %s", errorParam)
		result := &OAuthResult{
			Error: errorParam,
		}
		s.sendResult(result)
		http.Error(w, fmt.Sprintf("OAuth error: %s", errorParam), http.StatusBadRequest)
		return
	}

	if code == "" {
		log.Error("No authorization code received")
		result := &OAuthResult{
			Error: "no_code",
		}
		s.sendResult(result)
		http.Error(w, "No authorization code received", http.StatusBadRequest)
		return
	}

	if state == "" {
		log.Error("No state parameter received")
		result := &OAuthResult{
			Error: "no_state",
		}
		s.sendResult(result)
		http.Error(w, "No state parameter received", http.StatusBadRequest)
		return
	}

	// Send successful result
	result := &OAuthResult{
		Code:  code,
		State: state,
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Re-run the login flow and open the auth URL directly in a browser, not through chat/email preview layers
2. Confirm the exact redirect URI (including port from --oauth-callback-port) matches the app registration
3. Free the callback port from other processes before starting login

u, err := url.Parse(callbackURL)
if err == nil && u.Query().Get("error") == "" && u.Query().Get("code") == "" {
    return errors.New("callback URL missing code parameter")
}

func callbackHasCode(u *url.URL) bool { return u.Query().Get("code") != "" }

result, err := server.WaitForCode(ctx)
if err == nil && result.Error == "no_code" { /* restart login; verify redirect URI, port, and no prefetching middlemen */ }

When it happens

Trigger: GET /callback with empty/absent code (?state only, bare path, or code renamed/removed); prefetchers hitting the callback URL before the real browser redirect.

Common situations: Chat clients (Slack/Teams) or security tools prefetching the loopback callback link and stripping parameters; redirect URI mismatch causing the provider to omit code; manual URL editing during debugging; port conflicts so the callback lands on the wrong local server.

Related errors

• timeout waiting for OAuth callback
• No authorization code received
• Method not allowed
• OAuth error: %s
• missing access_token and refresh_token

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/0de737e8195da344. Report an issue: GitHub.