NodeJS Demo: Getting "Unauthorized" error

[mtaiyabm]

I simply downloaded the demo code. Following the instructions executed

npm install
npm start

Opened it in chrome browser
http://localhost:3080/
Logged in using S7790795E / T4!vY9@xL7$p

The page redirects to the following URL showing "Unauthorized" on the page.
http://localhost:3080/callback?code=hfHuOZyAEV--zvckPwABxUNIQPR6QGmD2qSwz0DM6R0&state=t0rYhuwcyggJXRC436k3s8L6hUjFwR9jwLeKBXpvc-s

In logs I see the following error.

ClientError: unexpected HTTP response status code
    at e (.../node_modules/openid-client/src/index.ts:911:10)
    at errorHandler (.../node_modules/openid-client/src/index.ts:932:15)
    at Module.fetchUserInfo (.../node_modules/openid-client/src/index.ts:4100:5)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async handleSingpassCallback (.../src/router.ts:153:22)
    at async session (.../node_modules/koa-session/src/index.ts:216:7)
    at async serve (.../node_modules/koa-static/index.js:53:9)
    at async logger (.../node_modules/koa-logger/index.js:130:7) {
  code: 'OAUTH_RESPONSE_IS_NOT_CONFORM',
  [cause]: Response {
    status: 400,
    statusText: 'Bad Request',
    headers: Headers {
      date: 'Sat, 21 Feb 2026 19:23:41 GMT',
      'content-type': 'application/jwt; charset=utf-8',
      'content-length': '196',
      connection: 'keep-alive',
      'content-security-policy': "default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests",                                                                                                                                   
      'cross-origin-opener-policy': 'unsafe-none',
      'cross-origin-resource-policy': 'same-origin',
      'origin-agent-cluster': '?1',
      'referrer-policy': 'no-referrer',
      'strict-transport-security': 'max-age=15552000; includeSubDomains',
      'x-content-type-options': 'nosniff',
      'x-dns-prefetch-control': 'off',
      'x-download-options': 'noopen',
      'x-frame-options': 'SAMEORIGIN',
      'x-permitted-cross-domain-policies': 'none',
      'x-xss-protection': '0',
      'x-singpass-request-id': '86524608-96cc-46ca-b9a5-a902c47b9330',
      vary: 'Origin',
      'access-control-allow-credentials': 'true',
      'access-control-expose-headers': 'X-Singpass-Request-Id,Retry-After,WWW-Authenticate',
      etag: 'W/"c4-xU8+XVEz0x6uVXZVOTQ5rpx9VSQ"'
    },
    body: ReadableStream { locked: false, state: 'readable', supportsBYOB: true },
    bodyUsed: false,
    ok: false,
    redirected: false,
    type: 'basic',
    url: 'https://stg-id.singpass.gov.sg/fapi/userinfo'
  }
}

Can anyone please help what is going wrong here. Thanks.

[mtaiyabm]

Fixed:

The default user credentials (S7790795E / T4!vY9@xL7$p) provided in the demo app README are not provisioned for MyInfo, meaning the test account does not contain MyInfo data.

The appropriate MyInfo test personas can be found here:
https://docs.developer.singpass.gov.sg/docs/testing/myinfo-test-personas

Using one of the accounts from the provided test personas resolved the issue successfully.

Thanks.