{"record":{"id":"2193319dfa4af344","repo":"RocketChat/Rocket.Chat","slug":"workspace-access-token-is-empty","errorCode":null,"errorMessage":"Workspace access token is empty","messagePattern":"Workspace access token is empty","errorType":"exception","errorClass":"CloudWorkspaceAccessTokenEmptyError","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/cloud/syncWorkspace/legacySyncWorkspace.ts","lineNumber":94,"sourceCode":"\tif (result.banners) {\n\t\tawait handleBannerOnWorkspaceSync(result.banners);\n\t}\n\n\tif (result.nps) {\n\t\tawait handleNpsOnWorkspaceSync(result.nps);\n\t}\n};\n\n/** @deprecated */\nexport async function legacySyncWorkspace() {\n\tconst { workspaceRegistered } = await retrieveRegistrationStatus();\n\tif (!workspaceRegistered) {\n\t\tthrow new CloudWorkspaceRegistrationError('Workspace is not registered');\n\t}\n\n\tconst token = await getWorkspaceAccessToken(true);\n\tif (!token) {\n\t\tthrow new CloudWorkspaceAccessTokenEmptyError();\n\t}\n\n\tconst workspaceRegistrationData = await buildWorkspaceRegistrationData(undefined);\n\n\tconst payload = await fetchWorkspaceClientPayload({ token, workspaceRegistrationData });\n\n\tif (payload) {\n\t\tawait consumeWorkspaceSyncPayload(payload);\n\t}\n\n\tawait getWorkspaceLicense();\n\n\treturn true;\n}\n","sourceCodeStart":76,"sourceCodeEnd":109,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/cloud/syncWorkspace/legacySyncWorkspace.ts#L76-L109","documentation":"In legacySyncWorkspace, after retrieveRegistrationStatus confirms the workspace is registered, getWorkspaceAccessToken(true) (forced refresh) came back empty, so it throws CloudWorkspaceAccessTokenEmptyError ('Workspace access token is empty'). getWorkspaceAccessToken deliberately returns '' when an offline license is applied or registration state disappears, and a failed cloud token fetch can also leave it falsy — so the server cannot obtain cloud credentials despite appearing registered.","triggerScenarios":"An offline license is applied (getWorkspaceAccessToken early-returns ''), registration state flipped between the status check and the token request, or the cloud token endpoint failed to issue a token (connectivity, invalid/expired client secret).","commonSituations":"Workspaces that went long periods without syncing so Cloud_Workspace_Client_Secret expired; interrupted registrations leaving partial Cloud_Workspace_* settings; cloud connectivity problems during token refresh; offline-licensed deployments reaching deprecated sync code.","solutions":["Re-register the workspace with Rocket.Chat Cloud to issue fresh client credentials.","Check the Cloud_Workspace_Client_Id / Client_Secret settings exist and Cloud_Workspace_Client_Secret_Expires_At is in the future.","Verify network access to the cloud token endpoint from the server.","Confirm no offline license is applied, and upgrade off the deprecated legacy sync path."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { License } from '@rocket.chat/license';\nimport { retrieveRegistrationStatus } from './retrieveRegistrationStatus';\nimport { settings } from '../../settings';\n\nconst { workspaceRegistered } = await retrieveRegistrationStatus();\nconst secretExpiry = settings.get<number>('Cloud_Workspace_Client_Secret_Expires_At');\nif (!workspaceRegistered || License.hasOfflineLicense() || (secretExpiry && secretExpiry < Date.now())) {\n  throw new Error('workspace cannot obtain a cloud token — re-register with Rocket.Chat Cloud');\n}\nawait legacySyncWorkspace();","typeGuard":"const canObtainCloudToken = async (): Promise<boolean> => {\n  const { workspaceRegistered } = await retrieveRegistrationStatus();\n  const expiresAt = settings.get<number>('Cloud_Workspace_Client_Secret_Expires_At');\n  return workspaceRegistered && !License.hasOfflineLicense() && (!expiresAt || expiresAt > Date.now());\n};","tryCatchPattern":"import { CloudWorkspaceAccessTokenEmptyError } from '../../lib/cloud/getWorkspaceAccessToken';\n\ntry {\n  await legacySyncWorkspace();\n} catch (e) {\n  if (e instanceof CloudWorkspaceAccessTokenEmptyError) {\n    // no cloud credentials obtainable: re-register the workspace, then retry the sync once\n  }\n  throw e;\n}","preventionTips":["Monitor Cloud_Workspace_Client_Secret_Expires_At and re-register before credentials lapse.","Verify cloud connectivity and license state as preconditions before running cloud syncs.","Treat an empty workspace token as a credentials problem — re-register rather than retrying blindly."],"tags":["rocket-chat","cloud","access-token","sync"],"backgroundTag":"cloud-access-token-missing","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}