{"record":{"id":"00f0f1e4ca34ffd5","repo":"different-ai/openwork","slug":"failed-to-verify-domain-response-status","errorCode":null,"errorMessage":"Failed to verify domain (${response.status}).","messagePattern":"Failed to verify domain \\((.+?)\\)\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx","lineNumber":287,"sourceCode":"    } catch (nextError) {\n      setError(nextError instanceof Error ? nextError.message : \"Failed to request domain verification.\");\n    }\n  }\n\n  async function handleVerifyDomain() {\n    if (!access.canManageSso) {\n      setError(\"Only workspace owners and super-admins can verify SSO domains.\");\n      return;\n    }\n    if (!orgId || !connection) return;\n    setError(null);\n    try {\n      await runReauthableAction(\"verify-sso-domain\", async () => {\n        setVerifyingDomain(true);\n        try {\n          const { response, payload } = await requestJson(\"/v1/sso/verify-domain\", { method: \"POST\", headers: getOrgScopedHeaders(), body: JSON.stringify({}) }, 12000);\n          if (response.status !== 204 && !response.ok) {\n            throw getRequestError(payload, response, `Failed to verify domain (${response.status}).`);\n          }\n          setDomainVerificationToken(null);\n          await loadSsoConfig();\n        } finally {\n          setVerifyingDomain(false);\n        }\n      });\n    } catch (nextError) {\n      setError(nextError instanceof Error ? nextError.message : \"Failed to verify the SSO domain.\");\n    }\n  }\n\n  function handleCancelEdit() {\n    syncFormFromConnection(connection);\n    setEditing(false);\n  }\n\n  const formReadOnly = !access.canManageSso;","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx#L269-L305","documentation":"Thrown by handleVerifyDomain when POST /v1/sso/verify-domain returns a status other than 204 or generic non-ok. The server checks the org's DNS TXT record for the issued domainVerificationToken; failure here is usually that the DNS record has not propagated or does not match. Success clears the token and reloads the SSO config.","triggerScenarios":"POST /v1/sso/verify-domain with org-scoped headers returns 400 (no pending domainVerificationToken was requested), 401 (expired session), 403 (not org admin / reauth challenge), 404 (verification request expired), 409/422 (TXT record not found or mismatched — DNS not propagated), 429, or 5xx. 12s timeout.","commonSituations":"Verifying minutes after adding the TXT record while DNS TTL hasn't elapsed; TXT record added to the wrong domain/subdomain or with wrong quoting; token expired and needs re-issue; the org never requested a token in this session.","solutions":["Confirm the TXT record exists via `dig TXT yourdomain.com +short` and exactly matches the issued domainVerificationToken (watch extra quotes).","Wait for DNS propagation (TTL up to hours) and retry — 409/422 here is almost always propagation lag.","If the token expired (404), call handleRequestDomainToken again to re-issue, publish, then verify.","Ensure a token was requested in this session (domainVerificationToken !== null) before verifying.","Handle ReauthRequiredError via re-authentication and check admin permissions for 403."],"exampleFix":"// before: immediate verify after showing token\nsetDomainVerificationToken(token);\nawait handleVerifyDomain();\n// after: guide the user through DNS first\nsetDomainVerificationToken(token);\nsetError(`Add TXT record _openwork to your domain with value ${token}, then verify after it propagates.`);\n// verification stays user-triggered; on 409/422 show retry-later message","handlingStrategy":"retry","validationCode":"if (!domainVerificationToken) { setError(\"Request a domain verification token first.\"); return; }\n// before verifying, optionally pre-check DNS from the client (informational only):\n// const txt = await fetch(`https://dns.google/resolve?name=_openwork.${domain}&type=TXT`)","typeGuard":"function isReauthRequiredError(e: unknown): e is ReauthRequiredError {\n  return e instanceof ReauthRequiredError;\n}","tryCatchPattern":"try {\n  await verifyDomain();\n} catch (err) {\n  if (isReauthRequiredError(err)) { promptSignIn(); return; }\n  if (/\\b(409|422)\\b/.test(err.message)) {\n    setError(\"TXT record not found yet — wait for DNS propagation and try again.\");\n    return; // retryable\n  }\n  if (/\\b404\\b/.test(err.message)) { setError(\"Verification request expired; request a new token.\"); return; }\n  setError(err.message);\n}","preventionTips":["Treat 409/422 as retryable DNS-propagation failures with a 'try again later' UX, not hard errors.","Show the exact TXT record (host _openwork, value = token) so users publish it correctly; warn about stray quotes in DNS panels.","Re-issue a token on 404 expiry via handleRequestDomainToken before re-verifying.","Only enable Verify after a token exists in state.","Add a short client-side debounce/cooldown so users don't hammer verify during propagation."],"tags":["http","sso","dns","domain-verification","den-web"],"backgroundTag":"http-request-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}