HumanSignal/label-studio · error · TokenError

Invalid Label Studio token

Error message

Invalid Label Studio token

What it means

Raised by TruncatedToken.__init__ when the supplied string does not contain at least two dot-separated parts (header and payload) of a JWT. The class truncates a token to its first two parts before adding a dummy signature, and rejects anything that cannot even be shaped like a JWT.

Source

Thrown at label_studio/jwt_auth/models.py:125

        Raises:
            rest_framework_simplejwt.exceptions.TokenError: If the token is already blacklisted.
        """
        self.check_blacklist()
        return super().blacklist()


class TruncatedLSAPIToken(LSAPIToken):
    """Handles JWT tokens that contain only header and payload (no signature).
    Used when frontend has access to truncated refresh tokens only."""

    def __init__(self, token, *args, **kwargs):
        """Initialize a truncated token, ensuring it has exactly 2 parts before adding a dummy signature."""
        # Ensure we have exactly 2 parts (header and payload)
        parts = token.split('.')
        if len(parts) > 2:
            token = '.'.join(parts[:2])
        elif len(parts) < 2:
            raise TokenError('Invalid Label Studio token')

        # Add dummy signature with exactly 43 'x' characters to match expected JWT signature length
        token = token + '.' + ('x' * 43)
        super().__init__(token, verify=False, *args, **kwargs)

View on GitHub (pinned to 0b49e9b539)

Solutions

1. Verify the token string has the form '<header>.<payload>' (JWT format) before calling
2. Re-issue the token from Label Studio (new JWT API token)
3. Strip surrounding whitespace/quotes that may corrupt the token
4. Use the correct token type: legacy API keys are not JWTs and need the legacy auth path

Example fix

// before
TruncatedToken(user_api_key)  # plain string, no dots
// after
if user_token.count('.') >= 1:
    TruncatedToken(user_token)
else:
    reissue_new_jwt_token()

def is_jwt_shaped(token: str) -> bool:
    parts = token.strip().split('.')
    return len(parts) >= 2 and all(parts)

def is_valid_ls_token(token: str) -> bool:
    return isinstance(token, str) and len(token.strip().split('.')) >= 2

try:
    tok = TruncatedToken(raw_token)
except TokenError:
    raise ValueError('Token is not JWT-shaped; re-issue from Label Studio')

When it happens

Trigger: Passing a malformed string (no '.', or only one segment) into the truncated-token wrapper used during API token authentication/inspection, e.g. a plain API key or corrupted token value.

Common situations: User pasted a non-JWT legacy token where a JWT token was expected; token truncated/corrupted in storage; whitespace or copy-paste errors dropped part of the token; passing an empty string.

Related errors

• Authentication token no longer valid: legacy token authentic
• token_exists
• Validation failed on {}: {}
• Label config contains non-unique names:
• toName="{toName}" not found in names: {sorted(names)}

AI-assisted analysis of HumanSignal/label-studio@0b49e9b539 (2026-08-29). Data as JSON: /api/errors/a961958ce81355ae. Report an issue: GitHub.