{"record":{"id":"13ce8462e5aa40f4","repo":"mastra-ai/mastra","slug":"okta-api-token-is-required-for-rbac-provide-it-in","errorCode":null,"errorMessage":"Okta API token is required for RBAC. Provide it in the options or set OKTA_API_TOKEN environment variable.","messagePattern":"Okta API token is required for RBAC\\. Provide it in the options or set OKTA_API_TOKEN environment variable\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"auth/okta/src/rbac-provider.ts","lineNumber":101,"sourceCode":"  }\n\n  /**\n   * Create a new Okta RBAC provider.\n   *\n   * @param options - RBAC configuration options\n   */\n  constructor(options: MastraRBACOktaOptions) {\n    const domain = options.domain ?? process.env.OKTA_DOMAIN;\n    const apiToken = options.apiToken ?? process.env.OKTA_API_TOKEN;\n\n    if (!domain) {\n      throw new Error(\n        'Okta domain is required. ' + 'Provide it in the options or set OKTA_DOMAIN environment variable.',\n      );\n    }\n\n    if (!apiToken) {\n      throw new Error(\n        'Okta API token is required for RBAC. ' +\n          'Provide it in the options or set OKTA_API_TOKEN environment variable.',\n      );\n    }\n\n    this.oktaClient = new Client({\n      orgUrl: `https://${domain}`,\n      token: apiToken,\n    });\n\n    this.options = options;\n\n    // Initialize LRU cache with configurable size and TTL\n    this.rolesCache = new LRUCache<string, Promise<string[]>>({\n      max: options.cache?.maxSize ?? DEFAULT_CACHE_MAX_SIZE,\n      ttl: options.cache?.ttlMs ?? DEFAULT_CACHE_TTL_MS,\n    });\n  }","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/okta/src/rbac-provider.ts#L83-L119","documentation":"The Okta RBAC provider needs an API token to authenticate requests against the Okta API. The constructor resolves it from options.apiToken, falling back to OKTA_API_TOKEN. Without it no client can be authenticated, so construction fails immediately.","triggerScenarios":"Calling `new MastraRBACOkta(options)` where options.apiToken is undefined and process.env.OKTA_API_TOKEN is unset/empty (note: this check happens after the domain check, so a missing domain masks it).","commonSituations":"API token never provisioned in the Okta admin console; secret not injected into the deployment environment; typo like OKTA_APITOKEN.","solutions":["Create an Okta API token in the Okta admin console and set OKTA_API_TOKEN","Pass it explicitly: new MastraRBACOkta({ domain, apiToken: 'your-token' })","Verify secret injection (CI/CD secrets, k8s secrets, .env loading) includes OKTA_API_TOKEN"],"exampleFix":"// before\nconst rbac = new MastraRBACOkta({ domain });\n// after\nconst rbac = new MastraRBACOkta({ domain, apiToken: process.env.OKTA_API_TOKEN });","handlingStrategy":"validation","validationCode":"function assertOktaToken(opts) {\n  const token = opts?.apiToken ?? process.env.OKTA_API_TOKEN;\n  if (!token || token.length < 10) throw new Error('OKTA_API_TOKEN missing or too short');\n  return token;\n}","typeGuard":"function hasOktaToken(o) {\n  return typeof o === 'object' && o !== null && typeof o.apiToken === 'string' && o.apiToken.length > 0;\n}","tryCatchPattern":"try {\n  rbac = new MastraRBACOkta(options);\n} catch (e) {\n  if (e.message.includes('OKTA_API_TOKEN')) {\n    console.error('Provide Okta API token via options.apiToken or OKTA_API_TOKEN env');\n    process.exit(1);\n  }\n  throw e;\n}","preventionTips":["Store OKTA_API_TOKEN in a secret manager, never in committed .env files","Check both OKTA_DOMAIN and OKTA_API_TOKEN together before constructing","Add a startup health check that instantiates the provider in staging first","Keep env var names in one constants module to avoid typos"],"tags":["config","env-var","okta","authentication","constructor"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}