What causes "no code received: %s" in sipeed/picoclaw?

Read the appended error text: access_denied means the user/admin declined — approve the app or grant consent

no code received: %s

Error message

no code received: %s

What it means

The provider redirected to the callback with no code but an error parameter (oauth.go:203); the provider's error text is appended to the message. The user-visible causes are consent denial (access_denied), the app not being approved/published for the account, or the account lacking access to the requested scopes.

Source

Thrown at pkg/auth/oauth.go:203

}

func oauthCallbackRedirectURI(port int) string {
	return fmt.Sprintf("http://localhost:%d/auth/callback", port)
}

func oauthCallbackHandler(state string, resultCh chan<- callbackResult) http.Handler {
	mux := http.NewServeMux()
	mux.HandleFunc("/auth/callback", func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Query().Get("state") != state {
			resultCh <- callbackResult{err: fmt.Errorf("state mismatch")}
			http.Error(w, "State mismatch", http.StatusBadRequest)
			return
		}

		code := r.URL.Query().Get("code")
		if code == "" {
			errMsg := r.URL.Query().Get("error")
			resultCh <- callbackResult{err: fmt.Errorf("no code received: %s", errMsg)}
			http.Error(w, "No authorization code received", http.StatusBadRequest)
			return
		}

		w.Header().Set("Content-Type", "text/html")
		fmt.Fprint(w, "<html><body><h2>Authentication successful!</h2><p>You can close this window.</p></body></html>")
		resultCh <- callbackResult{code: code}
	})
	return mux
}

func listenOAuthCallback(port int) (net.Listener, int, error) {
	listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
	if err != nil {
		return nil, 0, err
	}

	tcpAddr, ok := listener.Addr().(*net.TCPAddr)

View on GitHub (pinned to 49183d7e8d)

Solutions

Read the appended error text: access_denied means the user/admin declined — approve the app or grant consent
For Google clients in testing mode, add the user as a test user (or publish the app)
Verify client_id matches the one registered with the provider
Re-run the login and complete consent fully

Defensive patterns

Strategy: try-catch

Try / catch

if err != nil && strings.Contains(err.Error(), "no code received") {
    if strings.Contains(err.Error(), "access_denied") {
        fmt.Println("consent was denied — approve the app (or add the user as test user) and retry")
    } else {
        fmt.Printf("provider rejected login: %v\n", err)
    }
    return err
}

Prevention

For Google clients in testing mode, add users to the test-user list
Verify client_id matches the registered OAuth app
Surface the provider's error text to the user instead of generic failures

When it happens

Trigger: User clicks 'Deny'/'Cancel' on the consent screen; OAuth client in testing mode used by users outside the allow-list; admin-disabled app; requested scopes exceeding what the account may grant (admin_consent required).

Common situations: Google OAuth client in 'Testing' status with the user not added as a test user; workspace admin blocking third-party apps; user hitting 'cancel' accidentally.

Related errors

AI-assisted analysis of sipeed/picoclaw@49183d7e8d (2026-08-15). Data as JSON: /api/errors/ed26e75579f9c12e. Report an issue: GitHub.