Hmbown/CodeWhale · warning · anyhow::Error

The Codewhale account session expired. Run `codewhale accoun

Error message

The Codewhale account session expired. Run `codewhale account login` again

What it means

When an authenticated call returns 401, the CLI attempts a refresh-token exchange at /api/auth/refresh. If that refresh call itself returns 401, the refresh token is invalid (revoked/expired), so the local session is cleared and this message tells the user to re-authenticate from scratch.

Source

Thrown at crates/cli/src/cloud.rs:470

            body: body.clone(),
        })?;
        if first.status != 401 {
            return Ok(first);
        }

        let refresh = self.transport.execute(CloudRequest {
            method: HttpMethod::Post,
            path: "/api/auth/refresh".to_string(),
            bearer: None,
            body: Some(json_body(&RefreshRequest {
                refresh_token: &stored.bundle.refresh_token,
            })?),
        })?;
        match refresh.status {
            200 => {}
            401 => {
                self.clear_auth()?;
                bail!("The Codewhale account session expired. Run `codewhale account login` again");
            }
            _ => return Err(response_error(&refresh)),
        }
        let mut next: AuthBundle = parse_json_body(&refresh.body)?;
        validate_auth_bundle(&next)?;
        if next.user.is_none() {
            next.user = stored.bundle.user.take();
        }
        self.save_auth(next.clone())?;

        let retried = self.transport.execute(CloudRequest {
            method,
            path: path.to_string(),
            bearer: Some(next.access_token),
            body,
        })?;
        if retried.status == 401 {
            self.clear_auth()?;

View on GitHub (pinned to 0c42157ee5)

Solutions

Run `codewhale account login` again — the old session has already been cleared for you.
If it recurs unusually fast, verify system clock accuracy (NTP) on both client and any proxies.
Check whether your account's security policy revokes CLI sessions (then whitelist or re-authorize periodically).
Update the CLI in case of a token-handling change on the server.

Example fix

# before: stale session keeps failing every command
codewhale account me   # 401 -> refresh 401 -> this error

# after
codewhale account login
codewhale account me

Defensive patterns

Strategy: fallback

Try / catch

match client.execute_authenticated(...).await {
    Ok(r) => r,
    Err(e) if e.to_string().contains("session expired") => {
        // refresh already failed and local session was cleared; only re-login can recover
        run_login(profile).await?;
        client.execute_authenticated(...).await
    }
    Err(e) => Err(e),
}

Prevention

Expect long-idle sessions to need re-login; script a login check before batch runs.
Keep system clocks NTP-synced so tokens are not rejected early.
Note that this error already cleared the stale session — no manual cleanup needed.

When it happens

Trigger: Long-lived session whose access token and refresh token both expired; refresh token revoked server-side (password change, device management); clock skew making the server reject tokens; stale session written by an older CLI against a rotated signing key.

Common situations: Returning to a machine after weeks of idle, service-side token rotation/incident, signing in on the same account from a management UI that invalidates old sessions.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/6624f1b01db0ca52. Report an issue: GitHub.