fix: OpenRouter OAuth denial redirects show provider errors by VectorPeak · Pull Request #105448 · openclaw/openclaw

VectorPeak · 2026-07-12T14:17:23Z

What Problem This Solves

Fixes an issue where users completing OpenRouter OAuth through the manual redirect paste flow would see "Missing 'code' parameter in redirect URL." when OpenRouter returned an authorization error such as error=access_denied.

This affects remote/VPS OAuth setup directly, and it can also affect local setup when the browser callback is not detected and OpenClaw asks the user to paste the redirect URL manually.

Why This Change Was Made

The pasted redirect parser now validates the callback state first, then surfaces OpenRouter's error and optional error_description before requiring an authorization code.

The local callback server path now follows the same state-first ordering before surfacing provider errors, and includes error_description in the local callback error text. This keeps both OpenRouter OAuth callback entry points aligned without changing the OAuth token exchange, provider-auth core, browser-open behavior, or credential storage.

User Impact

Users who deny an OpenRouter OAuth request, or receive another provider-side OAuth redirect error, now get the actionable provider error for the current login attempt instead of a misleading missing-code diagnostic.

For invalid or stale callbacks, OpenClaw still rejects the callback on the state check before trusting provider error text.

Evidence

Behavior proof from the user-facing manual paste fallback:

Manual redirect paste input:
http://localhost:3000/openrouter-oauth/callback?state=state-1&error=access_denied&error_description=Denied

Before:
Missing 'code' parameter in redirect URL.

After:
OpenRouter OAuth error: access_denied: Denied

User-realistic manual fallback call chain:

Remote/VPS OAuth setup, or local browser callback fallback
-> promptForOpenRouterRedirect()
-> ctx.prompter.text("Paste the OpenRouter redirect URL")
-> parseOpenRouterOAuthCallbackInput()
-> validate callback state
-> surface OpenRouter error / error_description before requiring code

Local callback sibling proof now uses the real localhost callback server helper and an HTTP request to the callback URL:

waitForOpenRouterOAuthCallback()
-> local HTTP GET /openrouter-oauth/callback?state=state-1&error=access_denied&error_description=Denied
-> state validation succeeds
-> HTTP 400 body: OpenRouter authentication failed: access_denied: Denied
-> rejected error: OpenRouter OAuth error: access_denied: Denied

State guard proof for malformed or stale callbacks:

/openrouter-oauth/callback?error=access_denied&error_description=Denied
-> Missing OpenRouter OAuth state

/openrouter-oauth/callback?state=wrong&error=access_denied&error_description=Denied
-> OpenRouter OAuth state mismatch

Dependency contract: OAuth authorization error redirects may carry error, optional error_description, and the original state; this PR preserves state validation before trusting provider error text.

Validation run locally:

git diff --check
node scripts/run-vitest.mjs run extensions/openrouter/oauth.test.ts

Result: extensions/openrouter/oauth.test.ts passed with 10 tests.

Co-authored-by: chatgpt-codex-connector[bot] <261883814+chatgpt-codex-connector[bot]@users.noreply.github.com>

clawsweeper · 2026-07-12T17:27:21Z

Codex review: needs maintainer review before merge. Reviewed July 12, 2026, 1:25 PM ET / 17:25 UTC.

Summary
The PR updates OpenRouter OAuth manual-paste and localhost callback handling to validate state before reporting provider denial errors, with focused regression tests.

PR surface: Source +10, Tests +68. Total +78 across 2 files.

Reproducibility: yes. from source with high confidence: current main reaches the missing-code branch for a denial URL without code, and its localhost sibling reads provider errors before checking state. This read-only review did not independently execute the flow.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #105447
Summary: The linked issue is the canonical report, and this PR is the direct candidate fix for its OpenRouter denial-redirect parsing defect.

Members:

canonical: OpenRouter OAuth pasted denial redirects report missing code #105447 - It describes the same denial URL, misleading missing-code result, affected manual fallback, and required state-first provider-error behavior.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

[P2] The active PR already contains the narrow fix and has no concrete defect for an automated repair lane; the remaining action is ordinary maintainer review and landing.

Security
Cleared: The patch strengthens the OAuth callback trust boundary by matching the expected state before reflecting provider-controlled error text, and it introduces no dependency or supply-chain changes.

Review details

Best possible solution:

Land the plugin-local state-first callback interpretation so both manual and localhost OpenRouter OAuth flows report actionable denial errors without accepting provider text from stale or unrelated callbacks.

Do we have a high-confidence way to reproduce the issue?

Yes, from source with high confidence: current main reaches the missing-code branch for a denial URL without code, and its localhost sibling reads provider errors before checking state. This read-only review did not independently execute the flow.

Is this the best way to solve the issue?

Yes. A shared state-first ordering within the OpenRouter plugin is the narrowest maintainable correction and avoids changes to token exchange, credential storage, core provider routing, or public plugin APIs.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7c5b66a1e46e.

Label changes

Label changes:

add P2: This fixes a real but provider-specific OAuth fallback diagnostic failure with limited blast radius and no evidence of credential loss or broad authentication outage.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body contains directly relevant after-fix manual-paste output and localhost HTTP callback output, including observed missing-state and mismatched-state rejection behavior.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body contains directly relevant after-fix manual-paste output and localhost HTTP callback output, including observed missing-state and mismatched-state rejection behavior.

Label justifications:

P2: This fixes a real but provider-specific OAuth fallback diagnostic failure with limited blast radius and no evidence of credential loss or broad authentication outage.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body contains directly relevant after-fix manual-paste output and localhost HTTP callback output, including observed missing-state and mismatched-state rejection behavior.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body contains directly relevant after-fix manual-paste output and localhost HTTP callback output, including observed missing-state and mismatched-state rejection behavior.

Evidence reviewed

PR surface:

Source +10, Tests +68. Total +78 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	24	14	+10
Tests	1	68	0	+68
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	92	14	+78

Acceptance criteria:

[P1] node scripts/run-vitest.mjs run extensions/openrouter/oauth.test.ts.
[P1] git diff --check.

What I checked:

Current-main behavior: The manual callback parser on current main requires code before validating state or inspecting OAuth error parameters, so a standards-shaped denial redirect produces the reported misleading missing-code diagnostic. (extensions/openrouter/oauth.ts:143, 7c5b66a1e46e)
State-first manual parsing: The proposed parser first verifies that the redirect belongs to the active login attempt, then reports error and optional error_description, and only then requires an authorization code. (extensions/openrouter/oauth.ts:146, 07f376e6f57c)
Aligned localhost callback: The localhost callback server now applies the same state-first ordering before reflecting provider error text or completing the callback promise. (extensions/openrouter/oauth.ts:241, 07f376e6f57c)
Regression coverage: The tests cover full-URL and query-only denial redirects, denial descriptions, and valid, absent, or mismatched state through both direct parsing and a real localhost HTTP request. (extensions/openrouter/oauth.test.ts:188, 07f376e6f57c)
OAuth dependency contract: RFC 6749 section 4.1.2.1 defines error, optional error_description, and requires returning the original state when it was present in the authorization request, matching the patch's state-first interpretation.
Feature provenance: Current-main blame attributes the OpenRouter OAuth module to Vincent Koc; repository history shows the implementation present in commit e085fa1 and subsequently maintained on main. (extensions/openrouter/oauth.ts:1, e085fa1a3ffd)

Likely related people:

vincentkoc: Current-main blame and file history attribute the OpenRouter OAuth implementation to Vincent Koc, making him the strongest code-history routing candidate. (role: feature-history owner; confidence: high; commits: e085fa1a3ffd, dfa9c96e17da; files: extensions/openrouter/oauth.ts, extensions/openrouter/oauth.test.ts)
altaywtf: GitHub currently assigns this PR to altaywtf, providing a direct live review and follow-up route. (role: assigned reviewer; confidence: medium; files: extensions/openrouter/oauth.ts, extensions/openrouter/oauth.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

altaywtf · 2026-07-13T12:37:32Z

Merged via squash.

Prepared head SHA: 011074559deca884d96a080abaeed409b1cef268
Landed commit: 79cc3c333bc83310dd0625c9982d5ae73f06b8cb

…#105448) * fix(openrouter): surface pasted OAuth redirect errors Co-authored-by: chatgpt-codex-connector[bot] <261883814+chatgpt-codex-connector[bot]@users.noreply.github.com> * fix(openrouter): align callback OAuth error state checks Co-authored-by: chatgpt-codex-connector[bot] <261883814+chatgpt-codex-connector[bot]@users.noreply.github.com> * test(openrouter): initialize callback readiness --------- Co-authored-by: chatgpt-codex-connector[bot] <261883814+chatgpt-codex-connector[bot]@users.noreply.github.com> Co-authored-by: Altay <[email protected]>

fix(openrouter): surface pasted OAuth redirect errors

ed2d321

Co-authored-by: chatgpt-codex-connector[bot] <261883814+chatgpt-codex-connector[bot]@users.noreply.github.com>

openclaw-barnacle Bot added extensions: openrouter size: XS labels Jul 12, 2026

altaywtf self-assigned this Jul 12, 2026

fix(openrouter): align callback OAuth error state checks

2a6730b

Co-authored-by: chatgpt-codex-connector[bot] <261883814+chatgpt-codex-connector[bot]@users.noreply.github.com>

openclaw-barnacle Bot added size: S and removed size: XS labels Jul 12, 2026

Merge branch 'main' into fix/openrouter-oauth-error-redirect-v2

07f376e

test(openrouter): initialize callback readiness

0110745

altaywtf merged commit 79cc3c3 into openclaw:main Jul 13, 2026
94 of 95 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: OpenRouter OAuth denial redirects show provider errors#105448

fix: OpenRouter OAuth denial redirects show provider errors#105448
altaywtf merged 4 commits into
openclaw:mainfrom
VectorPeak:fix/openrouter-oauth-error-redirect-v2

VectorPeak commented Jul 12, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 12, 2026

Uh oh!

Uh oh!

altaywtf commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

VectorPeak commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 12, 2026

Uh oh!

Uh oh!

altaywtf commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

VectorPeak commented Jul 12, 2026 •

edited

Loading