An exception shouldn't be making it to the user is the problem.

What seems to be going on here is that Cirrus is causing User to be loaded from the ApiBeforeMain hook. Since that's the sort of thing this hook was created for, what needs to happen is that the caller of that hook needs to be prepared to handle the exception.

FYI, I believe the error you're getting should be a response along the lines of this:

{"error":{"code":"mwoauth-invalid-authorization","info":"The authorization headers in your request are not valid: No approved grant was found for that authorization token."}}

Thanks. Any hint as to what is not valid in the header?

Change 117189 had a related patch set uploaded by Anomie:
API: Handle exceptions from ApiBeforeMain hook in a user-friendly manner

https://gerrit.wikimedia.org/r/117189

(In reply to Magnus Manske from comment #2)

Thanks. Any hint as to what is not valid in the header?

Is your consumer approved, or are you trying to use it from the same user account you used to register it?

If that's not it, are you correctly calculating the signature for your POST request? Remember that only application/x-www-form-urlencoded posts include the post data in the signature, multipart/form-data doesn't.

Actually, I got it to work now ;-) That bug should still be fixed though!

Change 117189 merged by jenkins-bot:
API: Handle exceptions from ApiBeforeMain hook in a user-friendly manner

https://gerrit.wikimedia.org/r/117189

This should be deployed to WMF wikis with 1.23wmf18, see https://www.mediawiki.org/wiki/MediaWiki_1.23/Roadmap for the schedule.