XTLS/Xray-core · error

invalid token + token

Error message

invalid token + token

What it means

Thrown by Realm.Build() when the userinfo component of the Realm URL is missing or unescapes to an empty token. The token is taken from u.User (the part before '@'), percent-decoded with url.PathUnescape, and must be non-empty — it authenticates the Realm session.

Source

Thrown at infra/conf/transport_finalmask.go:861

	host = u.Hostname()
	if host == "" {
		return nil, errors.New("invalid host", host)
	}

	port = u.Port()
	if port == "" {
		port = "443"
		if scheme == "http" {
			port = "80"
		}
	}

	token, err = url.PathUnescape(u.User.String())
	if err != nil {
		return nil, err
	}
	if token == "" {
		return nil, errors.New("invalid token", token)
	}

	id, err = url.PathUnescape(strings.TrimPrefix(u.EscapedPath(), "/"))
	if err != nil {
		return nil, err
	}
	if id == "" {
		return nil, errors.New("invalid id", id)
	}

	if len(c.StunServers) == 0 {
		return nil, errors.New("empty stunServers")
	}

	for _, s := range c.StunServers {
		_, _, err = net.SplitHostPort(s)
		if err != nil {
			return nil, err

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Add the token as userinfo: 'realm://<token>@host:port/id'.
2. Percent-encode special characters in the token rather than omitting it.
3. Check the injected secret is non-empty before building the config.

Example fix

// before
"url": "realm://signal.example.com:8443/v1"
// after
"url": "realm://mysecrettoken@signal.example.com:8443/v1"

u, _ := url.Parse(raw)
if u.User == nil || u.User.String() == "" {
    return fmt.Errorf("realm url is missing the token in userinfo")
}

When it happens

Trigger: A URL like 'realm://host:port/id' with no '<token>@' part triggers this. Also triggered when the token consists only of an escaped sequence that decodes to empty, or when '@' is URL-encoded as %40 so the parser sees no userinfo.

Common situations: Forgetting the credential portion when hand-assembling the URL; secrets managers returning an empty token; copy-paste from a share link that strips userinfo.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• invalid scheme + u.Scheme
• invalid host + host
• invalid id + id
• bridge tag is empty
• bridge domain is empty

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/601792e2860b1c37. Report an issue: GitHub.