The Cloudflare Gatekeeper collapses every non-2xx token response into null, so acceptAuthCode() reports the same "exchange failed or returned no refresh token" error for invalid client credentials, rejected grants, and provider failures.
This makes production OAuth failures unnecessarily difficult to diagnose. In one deployment, the provider returned 401 invalid_client, but the actionable cause was discarded before it reached Worker logs.
Expected behavior:
- Preserve the HTTP status and OAuth
error / error_description fields for rejected token exchanges.
- Do not include client credentials, authorization codes, access tokens, or refresh tokens in the error.
- Keep successful token parsing unchanged.
The provider error payload is the standard OAuth response and gives operators enough information to distinguish client configuration from grant and scope failures.
The Cloudflare Gatekeeper collapses every non-2xx token response into
null, soacceptAuthCode()reports the same "exchange failed or returned no refresh token" error for invalid client credentials, rejected grants, and provider failures.This makes production OAuth failures unnecessarily difficult to diagnose. In one deployment, the provider returned
401 invalid_client, but the actionable cause was discarded before it reached Worker logs.Expected behavior:
error/error_descriptionfields for rejected token exchanges.The provider error payload is the standard OAuth response and gives operators enough information to distinguish client configuration from grant and scope failures.