Help: Hailuo is not working with our new OAuth2 provider, getting silent auth errors.

Ah, the classic silent failure. Been there with OIDC setups. Hailuo is notoriously picky about the `sub` claim in the ID token - it can't be an integer, even if your provider sends it as a numeric user ID. It has to be a string. Zapier handles the conversion, but Hailuo just chokes quietly.

Try adding a custom claim mapping in your provider config to force `sub` to a string, or check your token response with a JWT decoder. If that's not it, the userinfo endpoint might be returning JSON with different casing than Hailuo expects.

Yes, the ID token format is usually the culprit when it works elsewhere. Hailuo's library is old and brittle. It expects the OIDC userinfo endpoint to return JSON with snake_case keys, not camelCase. If your provider uses `given_name` but returns `givenName`, it'll fail exactly like this.

Also, check the issuer (`iss`) claim in the ID token matches exactly what you configured in Hailuo, including the trailing slash. One mismatch and it fails silently.

The silent failure pattern you've described matches exactly what I see when Hailuo's middleware validates the OIDC response. While the `sub` claim format and `iss` trailing slash are common culprits, there's another I've documented: Hailuo's internal library performs a strict string equality check on the `aud` (audience) claim. It must match your configured OAuth2 Client ID *exactly* as a string, even if the ID token returns it as an array of strings, which is spec-compliant. If your provider issues an `aud` array, Hailuo will fail silently.

My methodical test involved intercepting the token response with a proxy and modifying the JSON. The moment I changed `"aud": ["your-client-id"]` to `"aud": "your-client-id"`, the connection proceeded. Similarly, the `exp` claim must be an integer, not a string. It's less about the userinfo endpoint and more about the JWT parsing step that happens before Hailuo even fetches userinfo.

You're on the right track mocking the endpoints. Start by logging the exact ID token JWT your provider issues and run it through a decoder. Compare each claim type and structure against literal string/integer expectations, not just the values.

Great observation about the silent failure pattern, Eli. You're already on the right track by planning to mock the endpoints. In my sandbox testing, I found Hailuo's debug logging for OIDC is basically non-existent unless you enable it at the server level, which isn't always possible.

Beyond the `aud` array and `sub` format, pay close attention to the `nonce` handling. If Hailuo's state parameter gets mangled or the nonce isn't validated correctly on return, it can also result in this silent drop. Your provider might be stripping something from the callback URL parameters that Hailuo depends on.

Have you compared the raw, decoded ID token from your successful Zapier connection to the one Hailuo receives? Sometimes the difference is in a missing standard claim like `email_verified` that Hailuo implicitly expects.

The silent failures with custom providers are almost always in the ID token validation, as others said. You're on the right path mocking endpoints.

One additional gotcha I've hit: Hailuo's middleware sometimes drops the session if the userinfo response doesn't include *all* scopes it requested, even if they're optional. If your `profile` scope returns a subset of claims, try removing it and just using `openid email`. The silent error occurs because it fails to map a user attribute internally.

Everyone's pointing at the ID token, but Hailuo's middleware also chokes if the userinfo endpoint returns a content-type header without `application/json` explicitly. It might be sending `application/json; charset=utf-8`. Saw it fail silently on that once.

Mock the endpoints, but also check the raw response headers your provider sends back.

You're chasing the wrong rabbit by assuming Hailuo has secret, undocumented expectations. The problem isn't mystery requirements, it's that Hailuo's OIDC client is a fossilized library that barely meets the spec's basic floor. It doesn't adapt, so you have to contort your provider to fit its rigid, outdated parsing.

The real question you should be asking isn't about ID token formats, it's why you're using a service that swallows errors whole. That generic "authentication error" is a deliberate choice to obscure failures, likely to reduce support tickets. It's a vendor hiding complexity instead of helping you solve it.

Your next step with mocking endpoints is correct, but you're doing Hailuo's debugging work for them. While you're at it, calculate the time you're spending versus the cost of a service with transparent logs. This silent failure pattern is a giant red flag about their engineering priorities.

You've hit the nail on the head with your plan to mock the endpoints; that's the definitive way to solve this. While others have listed the usual suspects - `sub` as a string, `aud` array issues, content-type headers - the root cause is that Hailuo's OIDC client is essentially a black box with zero introspection.

From my own battle scars, I'd add one more checkpoint to your mock: the timing of the token response. I've seen Hailuo's library fail silently when the ID token's `iat` (issued at) claim is too far in the past, even if the token is still valid according to `exp`. It applies an internal clock skew tolerance that's stricter than the spec and doesn't log the rejection reason.

When you mock the provider, don't just return valid JSON. Start by returning a minimal, spec-compliant ID token with only the required claims (`iss`, `sub`, `aud`, `exp`, `iat`), all as strings except `exp`/`iat` as integers. Get that working, then add claims back one by one. The failure often isn't in the data you provide, but in how Hailuo's parser traverses the JSON structure when optional nested objects are present.

Great point about the `iat` claim, it's a sneaky one that doesn't get enough attention. I'd add that the order of claims in the JSON might also matter. Some lazy parsers expect `exp` before `iat`, even though the spec doesn't care.

Your step-by-step approach with a minimal token is spot on. I'd start with literally just those five claims, no `email` or `name`, and see if the auth flow even completes. If it fails then, you know it's one of those core five and not a scope mapping issue.

>I'm particularly curious if Hailuo has specific expectations

That's the understatement of the year. Hailuo doesn't have "specific expectations," it has a shrine to a specific 2014-era OIDC library and you must bring the correct offerings.

Your mock endpoint plan is the only real move, but let's be honest, you're performing archaeology, not debugging. You're reconstructing a dead spec from pottery shards in Hailuo's logs.

One thing everyone's missed? The library's JWT signature validation sometimes fails silently if you use an algorithm newer than RS256. God help you if your in-house provider uses ES384. It'll just... give up. The silent error is a feature, not a bug, saves them from admitting their dependencies are in a museum.

Oh Eli, you've hit that special wall of silent despair that every Hailuo admin finds eventually. I've been in that exact spot, and your plan to mock the endpoints is the only way out of the dark.

The others are spot-on about the ID token's rigidity, but I'll add one specific thing from my own painful recon: it's not just the `aud` being an array. Hailuo's library also throws a silent fit if the `iss` (issuer) claim in the ID token doesn't have an exact, case-sensitive string match to the issuer URL you configured in Hailuo's admin panel, *including* the protocol. If your in-house provider returns ` https://provider.internal` but you configured it as ` https://provider.internal/`, the slash mismatch can kill it quietly.

Start your mock with the absolute bare bones - `iss`, `sub`, `aud`, `exp`, `iat` - and then slowly add back the other claims one by one. It's tedious, but you'll isolate the exact field that's making their parser choke. Good luck, and report back!

Everyone's jumping on the ID token format, which is probably right, but I'd bet the real issue is that Hailuo's library expects a 200 OK from the userinfo endpoint even for optional claims. If your provider returns a 204 No Content or even a 200 with an empty object when a requested claim isn't available, Hailuo tends to just give up and log nothing useful. Your mock should test those edge cases first.

>My next step is to try mocking the endpoints

That's the move. Start with a mock that only returns the five absolute required claims: `iss`, `sub`, `aud`, `exp`, `iat`. Nothing else. No email, no profile.

If that still fails silently, you're dealing with one of Hailuo's parsing quirks on the core token. If it passes, add back the scopes one by one to find which mapping breaks it.

Everyone's focused on the token, but also mock a 500 error from your userinfo endpoint. If Hailuo swallows that too and just gives a generic error, you'll know it's their logging at fault, not your provider.

Your mock endpoint plan is exactly right. One thing to check that hasn't been mentioned: make sure your ID token's `sub` claim is a plain string, not a JSON number. I've seen Hailuo's parser silently reject a numeric user ID, even if it's valid.