router-for-me/CLIProxyAPI · error

post-auth persist hook failed: %w

Error message

post-auth persist hook failed: %w

What it means

The post-persist hook h.postAuthPersistHook, run after store.Save already succeeded, returned an error. The credential itself is durably stored (savedPath is returned alongside the error), but follow-up side effects — typically config hot-reload or notification of the new auth — failed, leaving the running process potentially unaware of the new record until a reload.

Source

Thrown at internal/api/handlers/management/auth_files_fields.go:755

		return "", fmt.Errorf("token record is nil")
	}
	h.mergeExistingAuthFileMetadata(record)
	store := h.tokenStoreWithBaseDir()
	if store == nil {
		return "", fmt.Errorf("token store unavailable")
	}
	if h.postAuthHook != nil {
		if err := h.postAuthHook(ctx, record); err != nil {
			return "", fmt.Errorf("post-auth hook failed: %w", err)
		}
	}
	savedPath, errSave := store.Save(ctx, record)
	if errSave != nil {
		return savedPath, errSave
	}
	if h.postAuthPersistHook != nil {
		if errHook := h.postAuthPersistHook(ctx, record); errHook != nil {
			return savedPath, fmt.Errorf("post-auth persist hook failed: %w", errHook)
		}
	}
	return savedPath, nil
}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Treat the record as saved: verify with a GET on the auth list rather than re-saving blindly
2. Fix the hook's underlying failure using its wrapped error (watcher running, config writable)
3. Trigger a manual config reload or restart so the new credential is picked up
4. If the hook's work is retryable, retry just the reload rather than the whole save

savedPath, err := h.saveTokenRecord(ctx, record)
if err != nil && strings.HasPrefix(err.Error(), "post-auth persist hook") && savedPath != "" {
    // record IS persisted; trigger a manual reload instead of re-saving
    log.Warnf("auth persisted to %s but reload hook failed: %v", savedPath, err)
    err = nil
}

When it happens

Trigger: Saving an auth record when the persist hook that triggers watcher/config reload errors — unwritable config snapshot, watcher not running, or an embedder's custom post-persist logic failing after the file write.

Common situations: Config hot-reload infrastructure disabled or broken; embedders hooking cache invalidation that hits a dead dependency; transient errors during shutdown races.

Related errors

• failed to update auth %s: %w
• post-auth hook failed: %w
• failed to read auth file: %w
• invalid auth file: %w
• core auth manager unavailable

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/a5fbf25819aff44c. Report an issue: GitHub.