RocketChat/Rocket.Chat · error · CloudWorkspaceAccessTokenEmptyError

Workspace access token is empty

Error message

Workspace access token is empty

What it means

In legacySyncWorkspace, after retrieveRegistrationStatus confirms the workspace is registered, getWorkspaceAccessToken(true) (forced refresh) came back empty, so it throws CloudWorkspaceAccessTokenEmptyError ('Workspace access token is empty'). getWorkspaceAccessToken deliberately returns '' when an offline license is applied or registration state disappears, and a failed cloud token fetch can also leave it falsy — so the server cannot obtain cloud credentials despite appearing registered.

Source

Thrown at apps/meteor/server/lib/cloud/syncWorkspace/legacySyncWorkspace.ts:94

	if (result.banners) {
		await handleBannerOnWorkspaceSync(result.banners);
	}

	if (result.nps) {
		await handleNpsOnWorkspaceSync(result.nps);
	}
};

/** @deprecated */
export async function legacySyncWorkspace() {
	const { workspaceRegistered } = await retrieveRegistrationStatus();
	if (!workspaceRegistered) {
		throw new CloudWorkspaceRegistrationError('Workspace is not registered');
	}

	const token = await getWorkspaceAccessToken(true);
	if (!token) {
		throw new CloudWorkspaceAccessTokenEmptyError();
	}

	const workspaceRegistrationData = await buildWorkspaceRegistrationData(undefined);

	const payload = await fetchWorkspaceClientPayload({ token, workspaceRegistrationData });

	if (payload) {
		await consumeWorkspaceSyncPayload(payload);
	}

	await getWorkspaceLicense();

	return true;
}

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Re-register the workspace with Rocket.Chat Cloud to issue fresh client credentials.
  2. Check the Cloud_Workspace_Client_Id / Client_Secret settings exist and Cloud_Workspace_Client_Secret_Expires_At is in the future.
  3. Verify network access to the cloud token endpoint from the server.
  4. Confirm no offline license is applied, and upgrade off the deprecated legacy sync path.
Defensive patterns

Strategy: validation

Validate before calling

import { License } from '@rocket.chat/license';
import { retrieveRegistrationStatus } from './retrieveRegistrationStatus';
import { settings } from '../../settings';

const { workspaceRegistered } = await retrieveRegistrationStatus();
const secretExpiry = settings.get<number>('Cloud_Workspace_Client_Secret_Expires_At');
if (!workspaceRegistered || License.hasOfflineLicense() || (secretExpiry && secretExpiry < Date.now())) {
  throw new Error('workspace cannot obtain a cloud token — re-register with Rocket.Chat Cloud');
}
await legacySyncWorkspace();

Type guard

const canObtainCloudToken = async (): Promise<boolean> => {
  const { workspaceRegistered } = await retrieveRegistrationStatus();
  const expiresAt = settings.get<number>('Cloud_Workspace_Client_Secret_Expires_At');
  return workspaceRegistered && !License.hasOfflineLicense() && (!expiresAt || expiresAt > Date.now());
};

Try / catch

import { CloudWorkspaceAccessTokenEmptyError } from '../../lib/cloud/getWorkspaceAccessToken';

try {
  await legacySyncWorkspace();
} catch (e) {
  if (e instanceof CloudWorkspaceAccessTokenEmptyError) {
    // no cloud credentials obtainable: re-register the workspace, then retry the sync once
  }
  throw e;
}

Prevention

When it happens

Trigger: An offline license is applied (getWorkspaceAccessToken early-returns ''), registration state flipped between the status check and the token request, or the cloud token endpoint failed to issue a token (connectivity, invalid/expired client secret).

Common situations: Workspaces that went long periods without syncing so Cloud_Workspace_Client_Secret expired; interrupted registrations leaving partial Cloud_Workspace_* settings; cloud connectivity problems during token refresh; offline-licensed deployments reaching deprecated sync code.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/2193319dfa4af344. Report an issue: GitHub.