Repository navigation
credits: labs-gated on migrated accounts, and the error blames SAPISID for a host it never contacted #795
Description
Split out of #791 so fixing the login oracle does not leave a green auth status next to a red credits.
Two defects, one code path
api/credits.py:51 probes the labs NextAuth session unconditionally:
session_status, session_body, _ = await fetch_flow_session_httpx(profile_dir)then extracts access_token (:64-66) before calling routes.CREDITS with hardcoded origin/referer of https://labs.google (:80-81).
1. It stays broken on migrated accounts even after login is fixed
For an account Google has moved to flow.google.com, labs returns 200 {} with no access_token, so the run dies at credits.py:67-72 regardless of how the profile authenticated. If #791's oracle lands without this, the product reports "Flow session verified" and then fails gflow credits on the same profile — an inconsistent state that will read as a regression.
2. The error blames something that is not the cause and a host that was never contacted
The raise is AisandboxAuthError(detail="no access_token in Flow session", route="auth/session"), but the rendered title is "aisandbox-pa authentication failed" (errors.py:196) and the remediation says "SAPISID cookie missing, expired, or unreadable" (errors.py:198).
At that point aisandbox-pa has not been contacted at all, and SAPISID is present and fine — it is what made the outcome GOOGLE_SESSION_ONLY rather than NO_SESSION in the first place. A user following that remediation re-authenticates, which cannot help.
Reported downstream in #791: "gflow credits list → aisandbox-pa authentication failed".
Suggested shape
- Distinguish "the labs session BFF returned no token" from "aisandbox-pa rejected us" — they are different failures with different remediations, and only one of them is about SAPISID.
- Decide what
creditsmeans for a migrated account before wiring a new probe: the Veo balance surface for that cohort has not been located yet, so the honest interim may be a typed "not available on this host" rather than an auth error.
Surfaces
gflow credits user / gflow credits list, and the MCP twin if one exists — check the six mirror axes.
Refs #791
Activity
fix(795,796): two auth failures that blame the wrong cause (#797)
ffroliva commentedon Sep 12, 2026
Half fixed on
developin #797 (4d4ea3df).Landed — defect 2 (the misleading error). The
no access_tokenraise now carries an accurateremediation_hintinstead of inheriting "SAPISID cookie missing, expired, or unreadable". It names the real cause: labs.google's session carries no API token for this account, which is expected on accounts migrated toflow.google.com, and re-authenticating will not help. That re-login loop could never terminate on that cohort.Still open — defect 1 (
creditsis labs-only on migrated accounts).api/credits.py:51still probes the labs session unconditionally, sogflow creditsremains unavailable on the migrated host. That half needs a wire discovery: the Veo balance surface for the migrated cohort has not been located yet, and inventing a probe without measuring one would be a guess.Worth stating the ordering explicitly: this must not be forgotten when #791's login oracle lands. The moment a migrated account can authenticate,
auth statusgoes green whilecreditsstays red on the same profile — an inconsistent state that will read as a regression introduced by the login fix. Either the balance surface gets found first, orcreditsshould return a typed "not available on this host" for migrated accounts rather than an auth error.chore(559): say whether tonight's red is the same red as last night's (…
fix(795): keep the browser rescue where it is not proven useless
fix(795): finish both halves CodeRabbit found half-done
fix(795): stop re-deriving a credits auth verdict through a browser (#…
docs(plan)+fix(spike): apply council review findings
fix(auth): verify migrated sessions against flow.google.com (#791)
fix(auth): verify migrated sessions against flow.google.com (#791)
spike(ws2): credits on flow.google.com — price readable pre-submit, b…
ffroliva commentedon Sep 17, 2026
Related: #864 fixes the same pattern (a labs call failing on a flow.google.com account and advising a re-login) for
createProject, following the #797 approach used here.test(e2e): report an /about landing as the precondition it is, not a …
fix(auth): unknown labs state is not renewed; own the row rule in Ren…
fix(auth): scope the /about override, keep the self-checking credits …
fix(auth): unknown labs state is not renewed; own the row rule in Ren…
fix(auth): scope the /about override, keep the self-checking credits …
fix(credits): read the balance from the flow.google.com account popover
fix(auth): answer the #1025 council — credits and renew docs, login s…
docs(spike): a veo-lite spend moves nzlxg [0] and [5] together by 10 (#…
Merge pull request #1034 from ffroliva/bugfix/795-credits-on-flow
fix(auth): verify the session when labs.google's session URL is gone (f…
spike(credits): pre-register where flow.google.com carries the balance (
docs(spike): the credit balance rides the nzlxg reply on flow.google.…
fix(credits): read the balance from flow.google.com's nzlxg reply (ff…