usebruno/bruno · error · Error

Invalid token URL: ${requestConfig.url}

Error message

Invalid token URL: ${requestConfig.url}

What it means

Thrown by Bruno's OAuth2 helper (applyAdditionalParameters) when an additional parameter configured to be sent in queryparams cannot be appended because `new URL(requestConfig.url)` threw. The original URL parse error is swallowed and replaced with this message naming the offending URL.

Source

Thrown at packages/bruno-requests/src/auth/oauth2-helper.ts:86

 */
const applyAdditionalParameters = (requestConfig: RequestConfig, data: any, params: AdditionalParameter[] = []) => {
  params.forEach((param) => {
    if (!param.enabled || !param.name) {
      return;
    }

    switch (param.sendIn) {
      case 'headers':
        requestConfig.headers[param.name] = param.value || '';
        break;
      case 'queryparams':
        // For query params, add to URL
        try {
          const url = new URL(requestConfig.url);
          url.searchParams.append(param.name, param.value || '');
          requestConfig.url = url.href;
        } catch (error) {
          throw new Error(`Invalid token URL: ${requestConfig.url}`);
        }
        break;
      case 'body':
        // For body, add to data object
        data[param.name] = param.value || '';
        break;
    }
  });
};

/**
 * Safely parse JSON response data
 */
const safeParseJSONBuffer = (data: any) => {
  try {
    return JSON.parse(Buffer.isBuffer(data) ? data.toString() : data);
  } catch {
    return data;

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Set the OAuth2 Access Token URL to a fully-qualified absolute URL including scheme (https://...).
2. If the URL comes from a Bruno variable, confirm it is defined and non-empty in the active environment.
3. Move the parameter to headers or body if the URL is intentionally a relative path (the URL constructor is only invoked for the queryparams branch).

Example fix

// before — token URL has no scheme
requestConfig.url = 'example.com/oauth/token';
// + an additional param with sendIn: 'queryparams'

// after
requestConfig.url = 'https://example.com/oauth/token';

function assertAbsoluteUrl(u) {
  try { new URL(u); } catch { throw new Error('Invalid token URL: ' + u); }
}
assertAbsoluteUrl(requestConfig.url);

const isAbsoluteUrl = (v) => { try { new URL(v); return true; } catch { return false; } };

try { applyAdditionalParameters(requestConfig, data, params); }
catch (err) {
  if (/Invalid token URL/.test(err.message)) {
    requestConfig.url = 'https://' + requestConfig.url;
  } else throw err;
}

When it happens

Trigger: An OAuth2 token request whose Access Token URL is malformed (missing scheme, contains invalid characters, or is empty) and at least one additional parameter is set to sendIn: 'queryparams'.

Common situations: Token URL entered without the https:// scheme (e.g. 'example.com/oauth/token'); URL stored in a variable that resolved to undefined/empty; trailing space or stray character in the URL; a relative path used where an absolute URL is required.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• EdgeGrid: accessToken is required
• EdgeGrid: clientToken is required
• EdgeGrid: clientSecret is required
• Private key is required for ${method} signature method
• Unsupported OAuth1 signature method: ${method}

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/d0f58d9face97f22. Report an issue: GitHub.