apache/incubator-seata · error · AuthenticationFailedException

Invalid token, please log in to get a new token

Error message

Invalid token, please log in to get a new token

What it means

ConsoleRemoteServiceImpl.getToken throws AuthenticationFailedException when the credential string from the security context fails jwtTokenUtils.validateToken — i.e. the JWT is malformed, expired, or signature-invalid. This guards the forwarding of the caller's token to the naming server/TC, rejecting stale credentials before any remote hop.

Source

Thrown at console/src/main/java/org/apache/seata/mcp/service/impl/ConsoleRemoteServiceImpl.java:85

            JwtTokenUtils jwtTokenUtils,
            @Qualifier("consoleRestClient") RestClient restClient,
            ObjectMapper objectMapper,
            NamingServerProperties namingServerProperties) {
        this.jwtTokenUtils = jwtTokenUtils;
        this.restClient = restClient;
        this.objectMapper = objectMapper;
        this.namingServerProperties = namingServerProperties;
        LOGGER.info("ConsoleRemoteServiceImpl initialized.");
    }

    public String getToken() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !auth.isAuthenticated()) {
            throw new AuthenticationFailedException("No right to be identified");
        }
        String originJwt = (String) auth.getCredentials();
        if (!jwtTokenUtils.validateToken(originJwt)) {
            throw new AuthenticationFailedException("Invalid token, please log in to get a new token");
        }
        return WebSecurityConfig.TOKEN_PREFIX + originJwt;
    }

    public void setNamespaceHeaderAndQueryParam(
            NameSpaceDetail nameSpaceDetail, HttpHeaders headers, Map<String, String> queryParams) {
        headers.add("x-seata-namespace", nameSpaceDetail.getNamespace());
        if (StringUtils.isNotBlank(nameSpaceDetail.getvGroup())) {
            if (queryParams != null) {
                queryParams.put("vGroup", nameSpaceDetail.getvGroup());
            }
            return;
        }
        if (nameSpaceDetail.getCluster() != null) {
            headers.add("x-seata-cluster", nameSpaceDetail.getCluster());
        }
    }

View on GitHub (pinned to e01f97c6db)

Solutions

1. Log in again to obtain a fresh token — the message itself instructs this as the primary remedy
2. If tokens expire too quickly, increase the JWT ttl setting on the console
3. After changing the JWT secret, distribute the same secret to all console/naming-server nodes so issued tokens validate everywhere
4. Verify the Authorization header arrives intact ('Bearer <jwt>') through any gateway/proxy

if (!jwtTokenUtils.validateToken(currentToken)) { refreshToken(); }

try { token = service.getToken(); } catch (AuthenticationFailedException e) { relogin(); token = service.getToken(); }

When it happens

Trigger: Any console/MCP remote call made with a JWT past its expiry (ttl exceeded), a token signed with a different key (e.g. after server secret rotation), or a truncated/corrupted Authorization header value.

Common situations: Long-running console or MCP sessions outliving the token TTL; seata-server restarted with a regenerated JWT secret so old tokens fail signature validation; proxies stripping or mangling the Authorization header.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No right to be identified
• No naming servers addr configured
• The time format does not match yyyy-MM-dd
• The time format does not match yyyy-MM-dd HH:mm:ss
• MCP GET request failed with status: %s, response: %s

AI-assisted analysis of apache/incubator-seata@e01f97c6db (2026-08-14). Data as JSON: /api/errors/43e12f94c2ce0ba1. Report an issue: GitHub.