mirror of
https://github.com/jwadow/kiro-gateway.git
synced 2026-04-25 01:15:57 +03:00
[GH-ISSUE #45] BUG: 401 Unauthorized error when refreshing Kiro Desktop Auth token #32
Labels
No labels
bug
bug
enhancement
enhancement
fixed
fixed
invalid
needs-info
needs-testing
pull-request
question
upstream
wontfix
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/kiro-gateway-jwadow#32
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @somehow-paul on GitHub (Jan 19, 2026).
Original GitHub issue: https://github.com/jwadow/kiro-gateway/issues/45
Kiro Gateway Version
Current Latest Code
What happened?
As long as I click on 'query user usage' in Kiro, I will receive an error message 401 shortly thereafter.
I am using IDE login
Environment
OS: Windows
Debug Logs
2026-01-19 20:00:50 | ERROR | kiro.routes_anthropic:messages:332 - Internal error: Client error '401 Unauthorized' for url 'https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401
2026-01-19 20:00:50 | ERROR | kiro.routes_anthropic:messages:333 - HTTP 500 - POST /v1/messages - Client error '401 Unauthorized' for url 'https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken'
2026-01-19 20:00:50 | INFO | kiro.auth:_do_kiro_desktop_refresh:538 - Refreshing Kiro token via Kiro Desktop Auth...
2026-01-19 20:00:52 | WARNING | kiro.auth:_refresh_token_kiro_desktop:518 - Token refresh failed with 401, reloading credentials from file and retrying...
2026-01-19 20:00:52 | INFO | kiro.auth:_reload_credentials_from_file:485 - Reloading credentials from file: C:\Users\paulw.aws\sso\cache\kiro-auth-token.json
2026-01-19 20:00:52 | INFO | kiro.auth:_load_credentials_from_file:323 - Credentials loaded from C:\Users\paulw.aws\sso\cache\kiro-auth-token.json
2026-01-19 20:00:52 | INFO | kiro.auth:_do_kiro_desktop_refresh:538 - Refreshing Kiro token via Kiro Desktop Auth...
2026-01-19 20:00:54 | ERROR | kiro.routes_anthropic:messages:332 - Internal error: Client error '401 Unauthorized' for url 'https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401
2026-01-19 20:00:54 | ERROR | kiro.routes_anthropic:messages:333 - HTTP 500 - POST /v1/messages - Client error '401 Unauthorized' for url 'https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken'
@somehow-paul commented on GitHub (Jan 19, 2026):
Another issue is that when using OpenCode + Claude Code at high frequency, there's a chance of getting 500 errors instead of 429 errors. I haven't yet figured out a stable scenario to reproduce this issue consistently.
@uratmangun commented on GitHub (Jan 19, 2026):
@somehow-paul wait what you meant by opencode+claude are you opening it at the same time? im a little bit scared now i only open kiro cli to login first then open just one opencode instance for now let me know your experience first
@somehow-paul commented on GitHub (Jan 19, 2026):
I have multiple projects running simultaneously, and I keep Claude continuously writing and self-testing unit tests, so it's common for me to have multiple instances of OpenCode and Claude Code open at the same time. The most frustrating issue for me right now is the 401 error problem, as it causes the entire workflow to fail.
I've encountered three main issues in the Windows environment: First, there's a concurrency issue where sometimes I get 500 errors. Second, there's the 401 problem, but I don't know what triggers it. Third, there's an "input too long" issue. Oh, and there's also a tool invocation problem where excessively long tool context will cause the connection to drop directly.
That said, overall this is still an excellent open-source project.
Restarting the reverse proxy software resolves the issue every time.
If possible, I'd also like to use Claude Code to help fix these issues. However, I suspect these are most likely Windows compatibility problems.
@somehow-paul commented on GitHub (Jan 19, 2026):
2026-01-19 22:09:01 | INFO | kiro.routes_anthropic:messages:144 - Request to /v1/messages (model=claude-opus-4-5-20251101, stream=True)
2026-01-19 22:09:02 | WARNING | kiro.auth:_refresh_token_kiro_desktop:518 - Token refresh failed with 401, reloading credentials from file and retrying...
2026-01-19 22:09:02 | INFO | kiro.auth:_reload_credentials_from_file:485 - Reloading credentials from file: C:\Users\paulw.aws\sso\cache\kiro-auth-token.json
2026-01-19 22:09:02 | INFO | kiro.auth:_load_credentials_from_file:323 - Credentials loaded from C:\Users\paulw.aws\sso\cache\kiro-auth-token.json
2026-01-19 22:09:02 | INFO | kiro.auth:_do_kiro_desktop_refresh:538 - Refreshing Kiro token via Kiro Desktop Auth...
2026-01-19 22:09:04 | ERROR | kiro.routes_anthropic:messages:332 - Internal error: Client error '401 Unauthorized' for url 'https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401
2026-01-19 22:09:04 | ERROR | kiro.routes_anthropic:messages:333 - HTTP 500 - POST /v1/messages - Client error '401 Unauthorized' for url 'https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken'
2026-01-19 22:09:04 | INFO | kiro.debug_logger:flush_on_error:310 - [DebugLogger] Error logs flushed to debug_logs (status=500)
2026-01-19 22:09:04 | INFO | logging:callHandlers:1762 - 127.0.0.1:4987 - "POST /v1/messages?beta=true HTTP/1.1" 500
2026-01-19 22:09:05 | INFO | kiro.routes_anthropic:messages:144 - Request to /v1/messages (model=claude-haiku-4-5-20251001, stream=True)
2026-01-19 22:09:06 | INFO | logging:callHandlers:1762 - 127.0.0.1:4987 - "POST /v1/messages?beta=true HTTP/1.1" 200
2026-01-19 22:09:06 | INFO | kiro.routes_anthropic:stream_wrapper:288 - HTTP 200 - POST /v1/messages (streaming) - completed
2026-01-19 22:09:10 | INFO | logging:callHandlers:1762 - 127.0.0.1:4988 - "POST /v1/messages?beta=true HTTP/1.1" 200
2026-01-19 22:09:15 | INFO | kiro.routes_anthropic:stream_wrapper:288 - HTTP 200 - POST /v1/messages (streaming) - completed
2026-01-19 22:09:21 | INFO | kiro.routes_anthropic:messages:144 - Request to /v1/messages (model=claude-opus-4-5-20251101, stream=True)
2026-01-19 22:09:26 | INFO | logging:callHandlers:1762 - 127.0.0.1:5261 - "POST /v1/messages?beta=true HTTP/1.1" 200
@uratmangun commented on GitHub (Jan 19, 2026):
@somehow-paul i also have multiple usage in my server and my account actually not banned but i can only use claude-sonnet-4 because of that this is the email i got from aws:
do you also got this emai? its just my assumption but i think this is some mitigation in the kiro server if they detect suspicious behaviour you will definitely get a warning because we supposed to use this in kiro ide or kiro cli and not supposed to use this as an api lol so thats why probably you got what you got, also prior getting warning i also using it as an api, and then i also use it in opencode on my pc, opening it as well as kiro cli on my ssh and after that i think a week later i got that warning, right now i have kiro paid account but i only use it in my opencode in my pc just one kiro cli and opencode open and havent got warning yet i paid for kiro in 17th february, so its 3 days now hopefully not get a warning
@somehow-paul commented on GitHub (Jan 20, 2026):
My issue isn't about the warning - it's about the token not being refreshed. I'm not worried about my account being banned. If it gets banned, I'll just find other alternatives.
@somehow-paul commented on GitHub (Jan 20, 2026):
@somehow-paul commented on GitHub (Jan 20, 2026):
I captured the packets and took a look. It should be due to the enterprise AWS account - the request used to refresh the token is different from what's written in the code.
@jwadow commented on GitHub (Jan 20, 2026):
@somehow-paul
Thanks for the PR. Your clientIdHash detection and device registration loading logic works great. I've added it to the codebase.
One change I made: removed the conditional format logic. Both Enterprise IDE and kiro-cli now use JSON format with camelCase parameters - turns out that's what AWS SSO OIDC expects for both cases.
Your contribution is in the repo and you're in CONTRIBUTORS.md. Can you test this with your setup and confirm it works?
@somehow-paul commented on GitHub (Jan 20, 2026):
It works fine.