router-for-me/CLIProxyAPI · error

No authorization code received

Error message

No authorization code received

What it means

The Claude OAuth callback request carried no error but also no code query parameter, so there is no authorization code to exchange. The handler sends OAuthResult{Error: "no_code"} and returns HTTP 400 "No authorization code received".

Source

Thrown at internal/auth/claude/oauth_server.go:200

	// Validate required parameters
	if errorParam != "" {
		log.Errorf("OAuth error received: %s", errorParam)
		result := &OAuthResult{
			Error: errorParam,
		}
		s.sendResult(result)
		http.Error(w, fmt.Sprintf("OAuth error: %s", errorParam), http.StatusBadRequest)
		return
	}

	if code == "" {
		log.Error("No authorization code received")
		result := &OAuthResult{
			Error: "no_code",
		}
		s.sendResult(result)
		http.Error(w, "No authorization code received", http.StatusBadRequest)
		return
	}

	if state == "" {
		log.Error("No state parameter received")
		result := &OAuthResult{
			Error: "no_state",
		}
		s.sendResult(result)
		http.Error(w, "No state parameter received", http.StatusBadRequest)
		return
	}

	// Send successful result
	result := &OAuthResult{
		Code:  code,
		State: state,
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Re-run login and let the browser hit the callback untouched; don't copy/paste the URL manually
2. Register the exact callback URL (host+port+path) shown by the CLI in the provider app settings
3. Keep the callback port free of other services and avoid opening the auth link through link-preview-scanning chat tools

// If you control the callback URL (e.g. testing), validate params first:
q := u.Query()
if q.Get("error") == "" && q.Get("code") == "" {
    return errors.New("callback URL missing code parameter")
}

func callbackHasCode(u *url.URL) bool { return u.Query().Get("code") != "" }

result, err := server.WaitForCode(ctx)
if err == nil && result.Error == "no_code" { /* restart login; check redirect URI and proxies */ }

When it happens

Trigger: GET /callback with only ?state=xyz, with unrelated params, or with the code stripped/mangled by a proxy or manual URL editing; a redirect_uri mismatch that makes the provider omit the code.

Common situations: Manually pasting the callback URL minus query args; corporate proxies or browsers truncating long query strings; antivirus/link-scanners prefetching the callback URL and consuming/strip-mining parameters (Slack/Teams chat link previews are a classic); wrong redirect URI registered so the provider redirects without code.

Related errors

• callback_timeout
• Method not allowed
• OAuth error: %s
• No authorization code received
• antigravity token exchange: request failed: status %d

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/08fd1be7f7d1579c. Report an issue: GitHub.