{"record":{"id":"08953a02799429ed","repo":"micro/go-micro","slug":"errinvalidtoken","errorCode":"ErrInvalidToken","errorMessage":"invalid token provided","messagePattern":"invalid token provided","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth.go","lineNumber":21,"sourceCode":"\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"time\"\n)\n\nconst (\n\t// BearerScheme used for Authorization header.\n\tBearerScheme = \"Bearer \"\n\t// ScopePublic is the scope applied to a rule to allow access to the public.\n\tScopePublic = \"\"\n\t// ScopeAccount is the scope applied to a rule to limit to users with any valid account.\n\tScopeAccount = \"*\"\n)\n\nvar (\n\t// ErrInvalidToken is when the token provided is not valid.\n\tErrInvalidToken = errors.New(\"invalid token provided\")\n\t// ErrForbidden is when a user does not have the necessary scope to access a resource.\n\tErrForbidden = errors.New(\"resource forbidden\")\n)\n\n// Auth provides authentication and authorization.\ntype Auth interface {\n\t// Init the auth\n\tInit(opts ...Option)\n\t// Options set for auth\n\tOptions() Options\n\t// Generate a new account\n\tGenerate(id string, opts ...GenerateOption) (*Account, error)\n\t// Inspect a token\n\tInspect(token string) (*Account, error)\n\t// Token generated using refresh token or credentials\n\tToken(opts ...TokenOption) (*Token, error)\n\t// String returns the name of the implementation\n\tString() string","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/auth/auth.go#L3-L39","documentation":"ErrInvalidToken is the auth package's sentinel for a token that is not valid — missing, malformed, expired, or failing verification. Inspect and TokenFromMetadata return it, so callers should match with errors.Is to detect bad credentials.","triggerScenarios":"Calling auth Inspect or TokenFromMetadata with an empty metadata map, a missing/blank Authorization token, a token signed by the wrong key, or an expired/revoked token.","commonSituations":"Client not sending the Authorization header/metadata; JWT expiry on long-lived sessions; rotating signing keys so old tokens no longer verify; copying a token from the wrong environment; clock skew invalidating not-yet-valid or just-expired tokens.","solutions":["Ensure the client sends the token correctly (Authorization metadata/header present and non-empty)","Refresh or reissue the token — if expired, obtain a new one via login/refresh flow","Verify the auth service's signing key matches the issuer's key (no key-rotation mismatch)","Validate token format (correct scheme prefix, three-part JWT) before sending"],"exampleFix":"// before\nmd := metadata.New(nil) // no token attached\nacc, err := auth Inspect(ctx, md) // ErrInvalidToken\n// after\nmd := metadata.Pairs(\"authorization\", \"Bearer \"+token)\nacc, err := a.Inspect(ctx, md)\nif errors.Is(err, auth.ErrInvalidToken) {\n    token = refreshToken() // obtain a fresh token\n}","handlingStrategy":"type-guard","validationCode":"if token == \"\" {\n    return auth.ErrInvalidToken\n}\nparsed, err := jwt.Parse(token, keyFn)\nif err != nil || !parsed.Valid {\n    return auth.ErrInvalidToken\n}","typeGuard":"func hasToken(md metadata.MD) bool {\n    vals := md.Get(\"authorization\")\n    return len(vals) > 0 && strings.TrimSpace(vals[0]) != \"\"\n}","tryCatchPattern":"acc, err := a.Inspect(ctx, md)\nif errors.Is(err, auth.ErrInvalidToken) {\n    http.Error(w, \"unauthorized\", http.StatusUnauthorized)\n    return\n}\nif errors.Is(err, auth.ErrForbidden) {\n    http.Error(w, \"forbidden\", http.StatusForbidden)\n    return\n}","preventionTips":["Use errors.Is(err, auth.ErrInvalidToken) rather than string comparison","Refresh tokens proactively before expiry (e.g. on 401, retry once with a fresh token)","Keep signing keys in sync between issuer and verifier across key rotations","Validate the Authorization header is present and well-formed client-side before sending"],"tags":["go","auth","jwt","token","authentication"],"backgroundTag":"invalid-auth-token","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}