AlistGo/alist · error

lark tenant access token is empty

Error message

lark tenant access token is empty

What it means

getTenantAccessTokenBySelfBuiltApp succeeded (resp.Success() true) but TenantAccessToken came back empty. The tenant token authenticates app-level Drive calls (folder creation, listing); an empty one would make every subsequent API call anonymous. Guard fails fast right after the SDK success check.

Source

Thrown at drivers/lark/driver.go:453

			return "", err
		}
	}
	if accessToken != "" {
		return accessToken, nil
	}

	resp, err := c.client.GetTenantAccessTokenBySelfBuiltApp(ctx, &larkcore.SelfBuiltTenantAccessTokenReq{
		AppID:     c.AppId,
		AppSecret: c.AppSecret,
	})
	if err != nil {
		return "", err
	}
	if !resp.Success() {
		return "", errors.New(resp.Error())
	}
	if resp.TenantAccessToken == "" {
		return "", errors.New("lark tenant access token is empty")
	}
	return resp.TenantAccessToken, nil
}

func (c *Lark) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
	token, ok := c.getObjToken(ctx, parentDir.GetPath())
	if !ok {
		return nil, errs.ObjectNotFound
	}

	body, err := larkdrive.NewCreateFolderFilePathReqBodyBuilder().FolderToken(token).Name(dirName).Build()
	if err != nil {
		return nil, err
	}

	resp, err := doDrive(ctx, c, func(opts ...larkcore.RequestOptionFunc) (*larkdrive.CreateFolderFileResp, error) {
		return c.client.Drive.File.CreateFolder(ctx,
			larkdrive.NewCreateFolderFileReqBuilder().Body(body).Build(), opts...)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Verify AppId/AppSecret in the storage config exactly match the self-built app's credentials in the Feishu open platform console
2. Ensure the app is enabled/published and has drive scopes granted
3. Test credentials with a direct curl to the tenant_access_token endpoint to see the raw response
4. Update alist/lark SDK if the response schema changed

if strings.TrimSpace(c.AppId) == "" || strings.TrimSpace(c.AppSecret) == "" {
	return errors.New("lark app_id and app_secret are required")
}

tok, err := c.getTenantAccessToken(ctx)
if err != nil && strings.Contains(err.Error(), "tenant access token is empty") {
	// credentials accepted syntactically but app not usable: verify console state
	return "", fmt.Errorf("lark app returned no tenant token; check app status/scopes: %w", err)
}

When it happens

Trigger: Self-built-app token endpoint returns success envelope with blank tenant_access_token — wrong AppId/AppSecret combination accepted syntactically, app not published/enabled in the Feishu console, or response shape drift in the lark SDK.

Common situations: Copy-pasted app credentials with trailing whitespace or from a different app; app still in draft/unenabled state; missing required scopes so the endpoint returns a success body without a token.

Related errors

• lark refresh token expired
• lark refresh token response missing access token
• failed to get download link
• lark download requires web proxy
• lark file token not found

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/99ebe51a1eeefca2. Report an issue: GitHub.