What
Expired OAuth refresh tokens now throw a distinct OAuthRefreshDeadError with a clear message, rather than a generic error.
Details
- Message: "OAuth refresh token is no longer valid; run /login to re-authenticate"
- The error class name
"OAuthRefreshDeadError"is surfaced in logs and can be caught specifically by error handlers. - The error is thrown at API client construction time when all three conditions hold: no API key is available, no current OAuth access token exists, and
OGt()is true — meaning the stored OAuth refresh token is either an empty string""or is found in an in-memory dead-token blacklist set (populated whenever a token refresh request fails). - When this error propagates to the request error handler, the displayed UI message branches by session type: interactive REPL sessions show
"Login expired · Please run /login"; agent/non-interactive sessions show"Failed to authenticate: OAuth session expired and could not be refreshed". - The error condition is also checked in the first-party HTTP client's teleport-org auth path: after a forced token refresh attempt, if
OGt()is still true, the request returns{ ok: false, reason: "no-auth" }with the same detail message rather than throwing. - Previously, token expiry produced ambiguous error messages that did not distinguish between a missing token and a definitively-expired one.
Evidence
Error class (search for "OAuthRefreshDeadError"); dead-token check (search for "OGt()"); UI message branching (search for "Login expired" alongside "OAuthRefreshDeadError")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Gateway: /login now supports Anthropic-operated public gateway endpoints