router-for-me/CLIProxyAPI · error
plugin store resolved auth expired
Error message
plugin store resolved auth expired
What it means
validateResolvedAuthExpiry found that a cached/resolved plugin-store credential matching this URL and kind has passed its expiresAt (now is not before expiresAt). The store refuses to send a known-expired credential instead of provoking a guaranteed 401. Note the check only applies when a matching resolved auth config exists; unmatched URLs and zero expiry times are exempt.
Source
Thrown at internal/pluginstore/auth.go:340
return fmt.Errorf("insecure plugin store url requires matching allow-insecure auth rule")
}
return nil
}
func allowInsecurePluginStoreURL(auth []AuthConfig, requestURL string, kind string) bool {
item, ok := matchingAuthConfig(auth, requestURL, kind)
return ok && item.AllowInsecure
}
func validateResolvedAuthExpiry(auth []ResolvedAuthConfig, expiresAt time.Time, now time.Time, requestURL string, kind string) error {
if expiresAt.IsZero() {
return nil
}
if _, ok := matchingResolvedAuthConfig(auth, requestURL, kind); !ok {
return nil
}
if !now.Before(expiresAt) {
return fmt.Errorf("plugin store resolved auth expired")
}
return nil
}
func matchingAuthConfig(auth []AuthConfig, requestURL string, kind string) (AuthConfig, bool) {
requestURL = strings.TrimSpace(requestURL)
kind = strings.ToLower(strings.TrimSpace(kind))
for _, item := range NormalizeAuthConfigs(auth) {
if !pluginStoreURLMatchesAuthRule(requestURL, item.Match) {
continue
}
if !authAppliesTo(item, kind) {
continue
}
return item, true
}
return AuthConfig{}, false
}View on GitHub (pinned to 78f0c4079e)
Solutions
- Trigger re-resolution of the credential (re-run login / refresh the env-based token) so the store holds a fresh one
- Check system clock sync (NTP) if the token should still be valid
- Rotate to a longer-lived token for CI/automation contexts where refresh does not happen
- Remove the expired resolved-auth entry so requests fall back to unauthenticated or another rule
Defensive patterns
Strategy: validation
Validate before calling
func storeCredentialStillValid(resolved []ResolvedAuthConfig, requestURL, kind string, now time.Time) bool {
item, ok := matchingResolvedAuthConfig(resolved, requestURL, kind)
if !ok || item.ExpiresAt.IsZero() {
return true
}
return now.Before(item.ExpiresAt)
} Prevention
- Refresh store credentials on a timer well before expiresAt (e.g. at 80% of TTL)
- Keep system clocks NTP-synced so validity windows are evaluated correctly
- For automation, prefer long-lived static tokens (env-based) over short-lived resolved credentials
When it happens
Trigger: A resolved auth entry with an expiry (OAuth-derived store credential, short-lived token) matches the request URL and kind, and the current time is at or past expiresAt when a store fetch is attempted.
Common situations: Long-running server holding a cached store credential past its TTL; clock skew between the machine and the token issuer; token with a very short validity window; process resumed from suspend with stale auth state.
Related errors
- plugin store auth missing header-name
- unsupported plugin store auth type %q
- plugin store resolved auth token is empty
- plugin store resolved basic auth is incomplete
- plugin store resolved auth missing header-name
AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15).
Data as JSON: /api/errors/28f3260ecd50af2f.
Report an issue: GitHub.