Symptom-driven troubleshooting guide for HTTP/transport errors when integrating the Overlens IDP — the "why am I getting this status code?" skill. Use this whenever a developer is BLOCKED by an error response from the IDP or from their own auth flow and needs to map symptom → cause → fix: 401 invalidclient on /auth/token, 400 unauthorizedclient (grant type not allowed), 400 invalidgrant (code expired/reused/PKCE mismatch), 400 invalidredirecturi (redirecturi doesn't exact-match), 404 on POST /login/google (PostHog feature flag off — older docs said 403), 429 Too Many Requests (rate limit), Max-Age=0 cookies (the ms-vs-seconds bug), missing Set-Cookie (forgot credentials: 'include'), and CORS failures in prod that worked in dev (\.overlens\.com\.br$ origin regex). Triggers on phrases like "401 Overlens", "invalidclient Overlens", "CORS error Overlens", "Overlens login works locally but not in production", "429 Overlens rate limit", "Overlens cookie not being set", "Max-Age=0", "redirecturimismatch IDP", "unauthorizedclient Overlens", "my Overlens Google login returns 404 (or 403)", or any stuck-on-an-error-code report against the Overlens IDP. This skill diagnoses HTTP/transport/config failures. If instead the token IS received but its CONTENTS look wrong (bad iss/aud, kid not found, signature verify fails, decode the payload, algorithm-confusion, stale JWKS after rotation), prefer idp-debug-jwt. If nothing is failing yet and the dev just wants to integrate, prefer the integration skills (idp-integrate-oauth-web, idp-auth-nextjs, idp-integrate-m2m, idp-validate-token).
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Symptom-driven troubleshooting guide for HTTP/transport errors when integrating the Overlens IDP — the "why am I getting this status code?" skill. Use this whenever a developer is BLOCKED by an error response from the IDP or from their own auth flow and needs to map symptom → cause → fix: 401 invalidclient on /auth/token, 400 unauthorizedclient (grant type not allowed), 400 invalidgrant (code expired/reused/PKCE mismatch), 400 invalidredirecturi (redirecturi doesn't exact-match), 404 on POST /login/google (PostHog feature flag off — older docs said 403), 429 Too Many Requests (rate limit), Max-Age=0 cookies (the ms-vs-seconds bug), missing Set-Cookie (forgot credentials: 'include'), and CORS failures in prod that worked in dev (\.overlens\.com\.br$ origin regex). Triggers on phrases like "401 Overlens", "invalidclient Overlens", "CORS error Overlens", "Overlens login works locally but not in production", "429 Overlens rate limit", "Overlens cookie not being set", "Max-Age=0", "redirecturimismatch IDP", "unauthorizedclient Overlens", "my Overlens Google login returns 404 (or 403)", or any stuck-on-an-error-code report against the Overlens IDP. This skill diagnoses HTTP/transport/config failures. If instead the token IS received but its CONTENTS look wrong (bad iss/aud, kid not found, signature verify fails, decode the payload, algorithm-confusion, stale JWKS after rotation), prefer idp-debug-jwt. If nothing is failing yet and the dev just wants to integrate, prefer the integration skills (idp-integrate-oauth-web, idp-auth-nextjs, idp-integrate-m2m, idp-validate-token).
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Symptom-driven troubleshooting guide for HTTP/transport errors when integrating the Overlens IDP — the "why am I getting this status code?" skill. Use this whenever a developer is BLOCKED by an error response from the IDP or from their own auth flow and needs to map symptom → cause → fix: `401 invalid_client` on `/auth/token`, `400 unauthorized_client` (grant type not allowed), `400 invalid_grant` (code expired/reused/PKCE mismatch), `400 invalid_redirect_uri` (redirect_uri doesn't exact-match), `404` on `POST /login/google` (PostHog feature flag off — older docs said 403), `429 Too Many Requests` (rate limit), `Max-Age=0` cookies (the ms-vs-seconds bug), missing `Set-Cookie` (forgot `credentials: 'include'`), and CORS failures in prod that worked in dev (`\.overlens\.com\.br$` origin regex). Triggers on phrases like "401 Overlens", "invalid_client Overlens", "CORS error Overlens", "Overlens login works locally but not in production", "429 Overlens rate limit", "Overlens cookie not being set", "Max-Age=0", "redirect_uri_mismatch IDP", "unauthorized_client Overlens", "my Overlens Google login returns 404 (or 403)", or any stuck-on-an-error-code report against the Overlens IDP. This skill diagnoses HTTP/transport/config failures. If instead the token IS received but its CONTENTS look wrong (bad `iss`/`aud`, `kid not found`, signature verify fails, decode the payload, algorithm-confusion, stale JWKS after rotation), prefer `idp-debug-jwt`. If nothing is failing yet and the dev just wants to integrate, prefer the integration skills (`idp-integrate-oauth-web`, `idp-auth-nextjs`, `idp-integrate-m2m`, `idp-validate-token`).
About this listing
Category
Security
Reported license
MIT
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI