Pumpkin-MC/Pumpkin · error · LoginError

Could not parse UUID from validated token

Error message

Could not parse UUID from validated token

What it means

This is the LoginError::InvalidUuid variant. Pumpkin parses the client's UUID from the validated identity token's claims after chain validation succeeds. The library throws this when that UUID field is absent or cannot be parsed, since every player needs a stable unique ID for entity tracking and storage.

Solutions

1. Ensure the client obtains its token from the real Xbox Live/Mojang flow so the identity claim contains a valid UUID
2. If crafting test tokens, embed a canonical UUID string (e.g. 069a79f4-44e9-4726-a5be-fca90e38aaf5) in the claims
3. Check any auth proxy/middleware that it does not strip or reformat the UUID claim
4. Update the server if token claim layout changed in a newer Mojang auth version

Example fix

// before (hand-built test token)
json!({ "identity": "not-a-uuid", "displayName": "Steve" })
// after
json!({ "identity": "069a79f4-44e9-4726-a5be-fca90e38aaf5", "displayName": "Steve" })

// Caller-side UUID claim check before login
fn precheck_uuid(identity_claim: &str) -> Result<uuid::Uuid, String> {
    uuid::Uuid::parse_str(identity_claim).map_err(|_| "identity claim is not a valid UUID".to_string())
}

fn is_invalid_uuid(e: &LoginError) -> bool {
    matches!(e, LoginError::InvalidUuid)
}

match login_result {
    Err(LoginError::InvalidUuid) => {
        error!("token claims missing/invalid identity UUID; check auth proxy or client");
        disconnect_with("Login token missing a valid player UUID")
    }
    Err(e) => disconnect_with(&format!("Login failed: {e}")),
    Ok(p) => admit(p),
}

When it happens

Trigger: The validated JWT claims lack the expected identity/UUID field, or the field holds a string that is not a valid UUID (e.g. truncated text, base64 blobs, or an XUID where a UUID is expected).

Common situations: Custom or broken authentication proxies that rewrite token claims, modified clients omitting the identity claim, or testing harnesses that build tokens by hand with malformed UUID strings.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• JWT chain validation failed
• The validated username is invalid
• Cannot accept self-signed token. Authentication is enforced…
• Got a guest/splitscreen login request. Currently…
• Failed to parse chunk from bytes

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/9589acbeb4a225c6. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin/src/net/bedrock/login/mod.rs:38

};
use pumpkin_util::version::BedrockMinecraftVersion;
use pumpkin_world::{CURRENT_BEDROCK_MC_PROTOCOL, CURRENT_BEDROCK_MC_VERSION};
use serde::{Deserialize, de::Error};
use serde_repr::Deserialize_repr;
use std::sync::Arc;
use thiserror::Error;
use tracing::debug;
use uuid::Uuid;

#[derive(Debug, Error)]
pub enum LoginError {
    #[error("Login packet data is not valid JSON")]
    InvalidTokenFormat(#[from] serde_json::Error),
    #[error("JWT chain validation failed: {0}")]
    ChainValidationFailed(#[from] AuthError),
    #[error("The validated username is invalid")]
    InvalidUsername,
    #[error("Could not parse UUID from validated token")]
    InvalidUuid,
    #[error("Cannot accept self-signed token. Authentication is enforced by server config.")]
    SelfSignedNotAllowed,
    #[error("Got a guest/splitscreen login request. Currently unimplemented.")]
    GuestUnimplemented,
    #[error("Failed to decode extra using decode_b64_url_nopad.")]
    DecodeExtraError,
}

#[derive(Deserialize_repr)]
#[repr(u8)]
enum AuthenticationType {
    Full,
    Guest,
    SelfSigned,
}

#[derive(Deserialize)]

View on GitHub (pinned to 8d4639e25a)