router-for-me/CLIProxyAPI · error

PKCE codes are required for token exchange

Error message

PKCE codes are required for token exchange

What it means

Error "PKCE codes are required for token exchange" thrown in router-for-me/CLIProxyAPI.

Source

Thrown at internal/auth/claude/anthropic_auth.go:372

	return
}

// ExchangeCodeForTokens exchanges authorization code for access tokens.
// This method implements the OAuth2 token exchange flow using PKCE for security.
// It sends the authorization code along with PKCE verifier to get access and refresh tokens.
//
// Parameters:
//   - ctx: The context for the request
//   - code: The authorization code received from OAuth callback
//   - state: The state parameter for verification
//   - pkceCodes: The PKCE codes for secure verification
//
// Returns:
//   - *ClaudeAuthBundle: The complete authentication bundle with tokens
//   - error: An error if token exchange fails
func (o *ClaudeAuth) ExchangeCodeForTokens(ctx context.Context, code, state string, pkceCodes *PKCECodes) (*ClaudeAuthBundle, error) {
	if pkceCodes == nil {
		return nil, fmt.Errorf("PKCE codes are required for token exchange")
	}
	newCode, newState := o.parseCodeAndState(code)

	// Prepare token exchange request. The struct field order reproduces the key
	// order Claude Code 2.1.220 emits on the wire; a map would be re-sorted
	// alphabetically by encoding/json and change the serialized body bytes.
	reqBody := authorizationCodeExchangeRequest{
		GrantType:    "authorization_code",
		Code:         newCode,
		RedirectURI:  RedirectURI,
		ClientID:     ClientID,
		CodeVerifier: pkceCodes.CodeVerifier,
		State:        state,
	}

	// A state fragment appended to the callback code takes precedence.
	if newState != "" {
		reqBody.State = newState

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Complete the authorization step first to obtain the code, keeping the generated verifier.
2. Restart the OAuth flow if the PKCE verifier was lost between authorize and exchange.

When it happens

Trigger: Thrown at internal/auth/claude/anthropic_auth.go:372 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/7ca0055a7de79c2f. Report an issue: GitHub.