router-for-me/CLIProxyAPI · error

No state parameter received

Error message

No state parameter received

What it means

This error is returned by the local OAuth callback HTTP server used during the Codex OAuth login flow. After the provider redirects the browser back to the callback, the handler expects both 'code' and 'state' query parameters; 'state' is the anti-CSRF token generated when the flow started. If the callback request arrives without any state parameter, the server cannot correlate the response with the original request and rejects it with HTTP 400.

Source

Thrown at internal/auth/codex/oauth_server.go:207

	}

	if code == "" {
		log.Error("No authorization code received")
		result := &OAuthResult{
			Error: "no_code",
		}
		s.sendResult(result)
		http.Error(w, "No authorization code received", http.StatusBadRequest)
		return
	}

	if state == "" {
		log.Error("No state parameter received")
		result := &OAuthResult{
			Error: "no_state",
		}
		s.sendResult(result)
		http.Error(w, "No state parameter received", http.StatusBadRequest)
		return
	}

	// Send successful result
	result := &OAuthResult{
		Code:  code,
		State: state,
	}
	s.sendResult(result)

	// Redirect to success page
	http.Redirect(w, r, "/success", http.StatusFound)
}

// handleSuccess handles the success page endpoint.
// It serves a user-friendly HTML page indicating that authentication was successful.
//
// Parameters:

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Re-run the login flow from scratch (e.g. the oauth-login command) so a fresh state is generated and the full provider redirect is followed untouched
2. Check that the OAuth client/authorize configuration for Codex includes the state parameter in the authorization redirect and matches the registered redirect URI
3. Disable browser extensions or proxies that rewrite query parameters on localhost callback URLs
4. If automating the flow, ensure your script passes the entire callback URL (code AND state) through verbatim

Example fix

# before (manual/incomplete callback URL)
http://127.0.0.1:1455/callback?code=abc123

# after (full redirect as issued by the provider)
http://127.0.0.1:1455/callback?code=abc123&state=<state-from-authorize-request>

// On the callback URL before the server sees it, confirm both params exist:
const u = new URL(callbackUrl);
if (!u.searchParams.has('state') || !u.searchParams.has('code')) {
  throw new Error('Incomplete OAuth callback URL: code and state are both required');
}

When it happens

Trigger: A GET request to the OAuth callback URL (e.g. /callback) that carries a 'code' query parameter but no 'state' parameter, or an empty one. Typically caused by a hand-edited or truncated redirect URL, a provider/misconfigured OAuth app that drops state, or a user manually pasting an incomplete callback URL into the browser.

Common situations: Starting the login flow with --oauth-callback-port, then intercepting/altering the redirect; using a custom OAuth client configuration where the authorize URL was built without the state parameter; browser extensions or security tools stripping query parameters; replaying an old bookmarked callback URL after its state expired or was never issued.

Related errors

• missing access_token and refresh_token
• refresh response did not include access_token
• failed to save refreshed auth: %w
• port %d is already in use
• server failed to start: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/148b5c9704fd985d. Report an issue: GitHub.