idp-troubleshoot-auth-errors

Diagnose HTTP, cookie, CORS, and rate-limit errors in Overlens IDP integrations.

Updated Jul 24, 2026
One-click install
npx skills add https://github.com/overlens/claude-marketplace --skill idp-troubleshoot-auth-errors-overlens
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: idp-troubleshoot-auth-errors
Source: https://github.com/overlens/claude-marketplace/tree/main/plugins/idp-integration/skills/idp-troubleshoot-auth-errors
Command: npx skills add https://github.com/overlens/claude-marketplace --skill idp-troubleshoot-auth-errors-overlens

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When an Overlens IDP integration fails with a cryptic status code — a 401 on token exchange, a 429 rate limit, a cookie that never gets set, or CORS that works locally but breaks in production — developers waste hours guessing. This Skill maps each symptom (status code, error field, response headers) directly to its known cause and fix. ## Core Features & Use Cases - Symptom-to-cause master table: Maps 401 invalid_client, 400 invalid_grant, 400 invalid_redirect_uri, 404 on Google login, 429 rate limits, Max-Age=0 cookies, and CORS failures to precise root causes and fixes. - Diagnostic recipes: Copy-paste curl and browser commands to capture the exact status code, JSON error field, and response headers before attempting any fix. - Production-only failure checklist: A prioritized walkthrough for the classic "works locally, breaks in prod" scenario covering env vars, CORS origins, cookie domains, and redirect URI registration. - Use Case: A developer gets 401 invalid_client on /auth/token after deploying. The Skill identifies a malformed Authorization: Basic header or an empty IDP_CLIENT_SECRET env var in production and provides the base64 verification command to confirm it. ## Quick Start Ask the assistant why your Overlens login returns a 401 invalid_client error on the token endpoint and have it diagnose the cause.

Frequently Asked Questions about idp-troubleshoot-auth-errors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix a 401 invalid_client error on the OAuth token endpoint?

A 401 invalid_client on /auth/token means the client credential check failed: a wrong client_id or client_secret, a malformed Authorization Basic header, or a public client sending a secret. Base64-decode your Basic header to confirm it encodes exactly client_id:secret, and verify the secret env var is set in the deployed environment.

Why does my Overlens login work locally but fail in production?

Production-only failures are usually a missing env var, a CORS origin outside the *.overlens.com.br allowlist, a wrong cookie Domain attribute, or an unregistered production redirect_uri. Walk the checklist in order: env vars, CORS origin, cookie Secure/Domain settings, then redirect URI registration.

Why does POST /login/google return a 404 error?

A 404 on /login/google means the PostHog feature flag idp_google-auth is off, or POSTHOG_API_KEY is unset so flags fail closed. Enable the flag in PostHog and hide the Google button until it is on; it is not a missing route.

What causes a 429 Too Many Requests error from the Overlens IDP?

A 429 means you hit a per-IP, per-route rate limit, such as 10 requests per 60 seconds on /login or 30 per 60 seconds on /auth/token. Honor the Retry-After header, and for M2M clients cache the access token instead of fetching one per request.

Why is my authentication cookie not being set in the browser?

Missing cookies usually mean the fetch call lacks credentials: 'include', or the app is not hosted under *.overlens.com.br where cookie-mode applies. A Max-Age=0 value instead indicates an IDP-side bug where maxAge was passed in seconds instead of milliseconds.

When should I use JWT debugging instead of HTTP error troubleshooting?

Use JWT debugging when the token request succeeds but the token contents are wrong, such as bad iss or aud claims, kid not found, or signature verification failures. HTTP troubleshooting applies only when the request itself fails with an error status, missing cookie, or CORS rejection.