wandb/openui · error · ValueError

message

Error message

message

What it means

Raised inside OpenUI's GitHub OAuth callback endpoint: when GitHub redirects back with an error query parameter (incorrect_client_credentials, application_suspended, access_denied, etc.), the handler builds a human-readable message and raises ValueError(message), which surfaces as an HTTP 500. It means the GitHub login flow failed before an id_token could be verified.

Source

Thrown at backend/openui/server.py:330

async def callback(request: Request, error: str = "", error_description: str = ""):
    try:
        # if we've been given an error
        if error != "":
            logger.error("Oauth Error (%s): %s", error, error_description)
            message = "An error occurred when attempting to login with GitHub, please try again."
            if error == "bad_verification_code":
                message = "The code passed is incorrect or expired."
            elif error == "unverified_user_email":
                message = "You must verify your email address with GitHub to login."
            elif error == "redirect_uri_mismatch":
                message = "GitHub is not configured with the appropriate redirect url."
            elif error == "incorrect_client_credentials":
                message = "The application is not configured to login with GitHub, invalid client credentials"
            elif error == "application_suspended":
                message = "This application has been suspended by GitHub and can't accept new logins."
            elif error == "access_denied":
                message = "You've denied us access to verify your email with GitHub."
            raise ValueError(message)
        with github_sso:
            id_token = await github_sso.verify_and_process(request)
        # TODO: should probably key off email / update info
        user = User.get_or_none(User.username == id_token.display_name)
        if user is None:
            user_id = uuid.uuid4()
            user = User.create(
                id=user_id.bytes,
                username=id_token.display_name,
                email=id_token.email,
                created_at=datetime.now(),
            )
            user.id = user_id
        elif not user.email:
            user.email = id_token.email
            user.save()
        request.session["session_id"] = session_store.generate_session_id()
        request.session["user_id"] = str(user.id)

View on GitHub (pinned to 42d7ab4ab6)

Solutions

1. If credentials are wrong: verify GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET in the server environment match the GitHub OAuth App settings, then restart.
2. If suspended: contact GitHub Support to appeal the application suspension.
3. If access_denied: instruct the user to authorize the requested scopes; there is no server-side fix.
4. Check the Authorization callback URL configured in the GitHub app matches your deployed callback route.

Example fix

# before (.env with rotated secret not updated)
GITHUB_CLIENT_SECRET=old_secret
# after
GITHUB_CLIENT_SECRET=new_rotated_secret
# then restart the server

# before redirecting users to GitHub, verify app config
def verify_github_app_config(client_id, client_secret):
    if not client_id or not client_secret:
        raise RuntimeError("GitHub OAuth credentials missing")

const res = await fetch(`/auth/github/callback?${params}`);
if (!res.ok) {
  const body = await res.text();
  if (body.includes("incorrect_client_credentials")) {
    showAlert("Login is misconfigured; contact the administrator.");
  } else if (body.includes("access_denied")) {
    showAlert("You must authorize GitHub access to sign in.");
  } else {
    showAlert("GitHub login failed: " + body);
  }
}

When it happens

Trigger: Hitting /auth/github/callback with an error query param: the GitHub OAuth app has wrong client_id/client_secret, the GitHub App has been suspended by GitHub, or the user clicked 'Cancel'/'Deny' on the authorization screen.

Common situations: Misconfigured OAuth app credentials after rotating secrets, running against a GitHub App that GitHub suspended for policy violations, users denying the email-verification scope, or stale redirect URLs pointing at the wrong app.

Related errors

• Unexpected response ${r.status}: ${await r.text()}
• Unexpected response ${req.status}: ${await req.text()}
• No credential ID found
• Groq API key is not set.
• LiteLLM API key is not set.

AI-assisted analysis of wandb/openui@42d7ab4ab6 (2026-09-01). Data as JSON: /api/errors/66236431595291b0. Report an issue: GitHub.