SigNoz/signoz · error · errors SigNozError

CodeInvalidInput

CodeInvalidInput

Error message

refresh token is required

What it means

Thrown by PostableRotateToken.UnmarshalJSON when the refresh token field is missing. The token rotation endpoint requires the current refresh token to issue a new pair.

Source

Thrown at pkg/types/authtypes/token.go:117

func NewURLValuesFromToken(token *Token, rotationInterval time.Duration) url.Values {
	return url.Values{
		"tokenType":    {"bearer"},
		"accessToken":  {token.AccessToken},
		"refreshToken": {token.RefreshToken},
		"expiresIn":    {strconv.Itoa(int(time.Until(token.RotationAt(rotationInterval)).Seconds()))},
	}
}

func (typ *PostableRotateToken) UnmarshalJSON(data []byte) error {
	type Alias PostableRotateToken
	var temp Alias

	if err := json.Unmarshal(data, &temp); err != nil {
		return err
	}

	if temp.RefreshToken == "" {
		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "refresh token is required")
	}

	*typ = PostableRotateToken(temp)
	return nil
}

func (typ *Token) IsValid(rotationInterval time.Duration, idleDuration time.Duration, maxDuration time.Duration) error {
	// Check for expiration
	if err := typ.IsExpired(idleDuration, maxDuration); err != nil {
		return err
	}

	// Check for rotation
	if err := typ.IsRotationRequired(rotationInterval); err != nil {
		return err
	}

	return nil

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Send the current refreshToken value in the rotate request body
2. Persist new refresh tokens immediately after each rotation since they may be single-use
3. If lost, re-authenticate to obtain a fresh token pair

Example fix

// before
POST /api/v1/tokens/rotate {}
// after
POST /api/v1/tokens/rotate {"refreshToken": "eyJhbGciOi..."}

if req.RefreshToken == "" { return errors.New("refreshToken is required") }

When it happens

Trigger: POST to the token rotation endpoint with an empty or absent refreshToken in the body.

Common situations: Client lost or never stored the refresh token, token was already rotated and the old one consumed, or the field name is misnamed in the request.

Related errors

• ErrCodeTokenExpired
• ErrCodeTokenRotationRequired
• CodeUnauthenticated
• ErrCodeTokenOlderLastObservedAt
• ErrCodeResetPasswordTokenExpired

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/b4d71345e80e2a93. Report an issue: GitHub.