Repository navigation
[BUG] GitLab OAuth token not auto-refreshed on 401 during session #9711
Description
Description
When using GitLab Duo with OAuth authentication, if the access token expires during an active opencode session, the error GitLabError: Failed to get direct access token: 401 Unauthorized - {"error":"invalid_token","error_description":"Token is expired. You can either do re-authorization or token refresh."} occurs.
Restarting opencode fixes the issue because the loader function in @gitlab/opencode-gitlab-auth plugin has auto-refresh logic that runs at startup.
Root Cause
The GitLab auth plugin (@gitlab/opencode-gitlab-auth@1.3.0) has a refreshTokenIfNeeded() function that correctly handles token refresh, but it's only called in the loader() function during provider initialization.
When the token expires mid-session:
- The GitLab API returns 401
- opencode doesn't catch this error and trigger a token refresh
- The user has to restart opencode
Expected Behavior
opencode should intercept 401 "invalid_token" errors from GitLab API and automatically:
- Call the refresh token flow
- Retry the failed request with the new token
Workaround
Restart opencode — the token will be refreshed on startup.
Environment
- opencode version: 1.1.28
- @gitlab/opencode-gitlab-auth: 1.3.0
- OS: macOS
auth.json structure
{
"gitlab": {
"type": "oauth",
"access": "...",
"refresh": "...",
"expires": 1768953223555,
"enterpriseUrl": "https://gitlab.com"
}
}Suggestion
Add retry logic with token refresh in the GitLab provider's custom fetch or in the SDK error handling:
// In provider.ts gitlab custom loader
gitlab: async (input) => {
// ... existing code ...
return {
autoload: !!apiKey,
options: {
// ... existing options ...
fetch: async (input, init) => {
const response = await fetch(input, init)
if (response.status === 401) {
const body = await response.clone().json().catch(() => ({}))
if (body.error === 'invalid_token') {
// Trigger token refresh and retry
await refreshGitLabToken(providerID)
// Retry with new token
const newAuth = await Auth.get(providerID)
if (newAuth?.type === 'oauth') {
const headers = new Headers(init?.headers)
headers.set('Authorization', `Bearer ${newAuth.access}`)
return fetch(input, { ...init, headers })
}
}
}
return response
}
}
}
}
Activity
github-actions commentedon Jan 20, 2026
This issue might be a duplicate of existing issues. Please check:
Feel free to ignore if none of these address your specific case.
vglafirov commentedon Jan 21, 2026
Thanks for opening the issue and suggested fix. I knew about this problem. It was in my todo list. I will try to get this resolved asap.
nicehiro commentedon Jan 21, 2026
Just confirmed the issue existed when using ChatGPT OAuth authentication.
vglafirov commentedon Jan 21, 2026
@nicehiro Not sure what you mean. The issue isn't related to GitLab Duo provider?
nicehiro commentedon Jan 21, 2026
I’m not sure whether this is related to the GitLab Duo provider, but I’m seeing the same error (
Error: Token refresh failed: 401) when using ChatGPT OAuth authentication. It was working normally moments ago, and then it suddenly started failing with this error.vglafirov commentedon Jan 21, 2026
Let me clarify. You use ChatGPT Oauth to authenticate with OpenAI provider and it thrown 401 immediately or after some time, when token expires? Or you are trying to authenticate to Gitlab Duo, using ChatGPT OAuth? 🤔
rekram1-node commentedon Jan 21, 2026
@vglafirov I think it's an issue in multiple auth plugins, but it is a bug in the plugins themselves (including ours) afaik, since all the refresh logic is self contained to a plugin each one needs to implement proper refresh logic
fix(provider): add OAuth token refresh support for GitLab provider
keramblock commentedon Jan 22, 2026
can confirm that error(Error: Token refresh failed: 401) exists for openai codex connector
LiJie298 commentedon Jan 23, 2026
那么该如何快速解决呢
keramblock commentedon Jan 23, 2026
I don't know Chinese, but if Google Translate is correct, you just need to do this to reissue token:
SardorbekR commentedon Jan 26, 2026
@keramblock cannot find logout button though😅 checked everywhere
GreenStage commentedon Jan 26, 2026
+1
Akswii commentedon Jan 27, 2026
type the commands in your terminal @SardorbekR
vglafirov commentedon Feb 18, 2026
With #13850 merged and release, this issue has been fixed.
fix: resolve mid-session OAuth token refresh failures
github-actions commentedon Apr 20, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.