anomalyco/sst · error · Error

No auth resource found. Make sure to link the auth resource

Error message

No auth resource found. Make sure to link the auth resource to this function.

What it means

`session.verify` runs in your deployed function and looks for a linked SST auth resource in the `Resource` object (any value with a `publicKey`). It uses that public key to verify the JWT. If no resource in `Resource` has a `publicKey`, the runtime cannot verify tokens, so it throws this error telling you to link the auth resource to the function.

Source

Thrown at sdk/js/src/auth/session.ts:26

  SessionTypes extends Record<string, any> = {},
>() {
  type SessionValue =
    | {
        [type in keyof SessionTypes]: {
          type: type;
          properties: SessionTypes[type];
        };
      }[keyof SessionTypes]
    | {
        type: "public";
        properties: {};
      };

  return {
    async verify(token: string): Promise<SessionValue> {
      const auth = Object.values(Resource).find((value) => value.publicKey);
      if (!auth) {
        throw new Error(
          "No auth resource found. Make sure to link the auth resource to this function.",
        );
      }
      const publicKey = auth.publicKey;
      const result = await jwtVerify(
        token,
        await importSPKI(publicKey, "RS512"),
      );
      return result.payload as any;
    },
    async create(session: SessionValue) {
      const privateKey = await importPKCS8(
        // @ts-expect-error
        process.env.AUTH_PRIVATE_KEY || Resource.AUTH_PRIVATE_KEY,
        "RS512",
      );
      const token = await new SignJWT(session)
        .setProtectedHeader({ alg: "RS512" })

View on GitHub (pinned to a0bd20f762)

Solutions

1. Add the auth resource to the function's `link` array in sst.config.ts (e.g. `link: [auth]`) and redeploy.
2. Reference the auth resource in the function so SST's linker includes it in the Resource object.
3. If running locally, use `sst dev` (or `sst shell`) so linked resources are injected.
4. Upgrade the SST runtime SDK if the deployed function bundle is stale.

Example fix

// before: sst.config.ts
new sst.aws.Function("Api", { handler: "src/authorizer.handler" })
// after
new sst.aws.Function("Api", {
  handler: "src/authorizer.handler",
  link: [auth],
})

import { Resource } from "sst";
if (!Object.values(Resource).some((v: any) => v?.publicKey)) {
  throw new Error("Auth resource not linked. Add `link: [auth]` to this function in sst.config.ts and redeploy.");
}

function hasLinkedAuth(resource: Record<string, unknown>): boolean {
  return Object.values(resource).some((v) => typeof v === "object" && v !== null && "publicKey" in v);
}

try {
  const session = await session.verify(token);
} catch (e) {
  if (e instanceof Error && e.message.includes("No auth resource found")) {
    console.error("Deployment misconfiguration: link the auth resource to this function");
  }
  throw e;
}

When it happens

Trigger: Calling `session.verify(token)` from a function that was deployed without a `link: [auth]` (or an auth resource reference) in its SST resource binding, so `Resource` contains no entry with a `publicKey` field.

Common situations: Forgetting `link: [auth]` when defining the API route/queue/bucket function in `sst.config.ts`; calling verify from a locally-run script outside `sst dev`; renaming the auth resource and dropping it from links; runtime SDK version mismatch where the link payload lacks publicKey.

Related errors

• Missing token parameter
• Auth: issuer field must be set
• Base path configuration not found in ".next/routes-manifest.
• No AWS-Lambda preset detected for TanStack Start. Add the n
• No AWS-Lambda preset detected for TanStack Start. Update yo

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/e9da0a506024e57b. Report an issue: GitHub.