wandb/openui · error · Error

Unexpected response ${r.status}: ${await r.text()}

Error message

Unexpected response ${r.status}: ${await r.text()}

What it means

getPublicKey() fetches WebAuthn PublicKeyCredential options from the server with same-origin credentials and expects 200. Any other status throws an Error embedding the status and raw response text. It backs both registration (create=true) and authentication flows.

Source

Thrown at frontend/src/api/openui.ts:118

		c => c.codePointAt(0) ?? 0
	)
const asBase64 = (ab: ArrayBuffer | undefined) =>
	btoa(String.fromCodePoint(...new Uint8Array(ab ?? [])))
		.replaceAll('+', '-')
		.replaceAll('/', '_')

async function getPublicKey(username: string, create = false) {
	const r = await fetch(
		`${API_HOST}/${create ? 'register' : 'auth'}/${encodeURIComponent(
			username
		)}`,
		{
			credentials: 'same-origin'
		}
	)

	if (r.status !== 200) {
		throw new Error(`Unexpected response ${r.status}: ${await r.text()}`)
	}
	if (create) {
		return (await r.json()) as PublicKeyCredentialCreationOptions
	}
	return (await r.json()) as PublicKeyCredentialRequestOptions
}

interface AuthResponse {
	attestationObject?: ArrayBuffer
	clientDataJSON?: ArrayBuffer
	signature?: ArrayBuffer
	authenticatorData?: ArrayBuffer
}

async function post(
	username: string,
	creds: PublicKeyCredential,
	create = false

View on GitHub (pinned to 42d7ab4ab6)

Solutions

1. Ensure the user is authenticated (or correctly anonymous for registration) before requesting options.
2. Read the status + text in the browser network tab to find the server-side failure.
3. Verify the backend webauthn route exists and the API_HOST/reverse-proxy config is correct.
4. Catch this in register/auth and fall back to password auth or a friendly passkey message.

Example fix

// before
throw new Error(`Unexpected response ${r.status}: ${await r.text()}`)
// after
const text = await r.text()
if (r.status === 401) throw new Error('Please log in before using a passkey')
throw new Error(`Unexpected response ${r.status}: ${text.slice(0, 200)}`)

// ensure same-origin session exists before requesting passkey options
if (!document.cookie) throw new Error('Login required before passkey flow')

function isPublicKeyOptions(b: unknown): b is Record<string, unknown> {
  return typeof b === 'object' && b !== null && ('challenge' in (b as object))
}

try {
  const options = await getPublicKey(username, create)
} catch (e) {
  if (String(e).includes('401')) redirectToLogin()
  else showPasskeyError(e)
}

When it happens

Trigger: GET of WebAuthn options returning non-200: unauthenticated user requesting auth options, missing/failed session, or server misconfiguration of the relying-party settings.

Common situations: Calling the passkey flow without being logged in; server's webauthn endpoint 500s; reverse proxy returns 404/502 HTML which lands in the error text.

Related errors

• Unexpected response ${req.status}: ${await req.text()}
• No credential ID found
• body.error.message
• Unkown error: ${String(error)}
• Login required to use OpenUI

AI-assisted analysis of wandb/openui@42d7ab4ab6 (2026-09-01). Data as JSON: /api/errors/e2d7fadf68f8ac34. Report an issue: GitHub.