{"record":{"id":"270756d14145bf24","repo":"different-ai/openwork","slug":"sso-domain-verification-token-was-missing-from-the","errorCode":null,"errorMessage":"SSO domain verification token was missing from the response.","messagePattern":"SSO domain verification token was missing from the response\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx","lineNumber":262,"sourceCode":"      setError(\"Only workspace owners and super-admins can request SSO domain verification tokens.\");\n      return;\n    }\n    if (!orgId || !connection) return;\n    setError(null);\n    try {\n      await runReauthableAction(\"request-sso-domain-token\", async () => {\n        setRequestingDomainToken(true);\n        try {\n          const { response, payload } = await requestJson(\"/v1/sso/request-domain-verification\", { method: \"POST\", headers: getOrgScopedHeaders(), body: JSON.stringify({}) }, 12000);\n          if (!response.ok) {\n            throw getRequestError(payload, response, `Failed to request domain verification (${response.status}).`);\n          }\n\n          const token = typeof (payload as { domainVerificationToken?: unknown } | null)?.domainVerificationToken === \"string\"\n            ? (payload as { domainVerificationToken: string }).domainVerificationToken\n            : \"\";\n          if (!token) {\n            throw new Error(\"SSO domain verification token was missing from the response.\");\n          }\n          setDomainVerificationToken(token);\n        } finally {\n          setRequestingDomainToken(false);\n        }\n      });\n    } catch (nextError) {\n      setError(nextError instanceof Error ? nextError.message : \"Failed to request domain verification.\");\n    }\n  }\n\n  async function handleVerifyDomain() {\n    if (!access.canManageSso) {\n      setError(\"Only workspace owners and super-admins can verify SSO domains.\");\n      return;\n    }\n    if (!orgId || !connection) return;\n    setError(null);","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx#L244-L280","documentation":"handleRequestDomainToken requests an SSO domain-verification token from the Den API and expects the payload to contain a non-empty string at domainVerificationToken. If the token is absent, wrong-typed, or an empty string, it throws 'SSO domain verification token was missing from the response.' This blocks the DNS-verification flow from showing an invalid TXT record.","triggerScenarios":"POST/GET of the domain-verification token returns ok but payload.domainVerificationToken is undefined, not a string, or \"\" — e.g. domain not registered for the org, feature flag off, or server-side token generation failed silently.","commonSituations":"Org has no SSO domain configured yet so the API omits the token; admin lacks permission and API returns 200 with an empty payload; server version predates the domainVerificationToken field; a captive proxy returns an unexpected JSON body.","solutions":["Log/inspect the raw payload to confirm domainVerificationToken is absent vs empty vs differently named.","Verify the domain is registered for the org and the requesting admin has SSO admin permissions, then retry the request.","Check server version exposes domainVerificationToken; upgrade/redeploy the Den API if the field is missing.","Ensure the client reads the correct response field if the API renamed it (update the payload typing)."],"exampleFix":"// before\nconst token = typeof payload?.domainVerificationToken === \"string\" ? payload.domainVerificationToken : \"\";\nif (!token) throw new Error(\"SSO domain verification token was missing from the response.\");\n// after\nconst token = typeof payload?.domainVerificationToken === \"string\" ? payload.domainVerificationToken\n  : typeof payload?.data?.domainVerificationToken === \"string\" ? payload.data.domainVerificationToken : \"\";\nif (!token) throw new Error(`SSO domain verification token missing. Payload keys: ${payload ? Object.keys(payload).join(\",\") : \"null\"}`);","handlingStrategy":"type-guard","validationCode":"function hasDomainVerificationToken(v: unknown): v is { domainVerificationToken: string } {\n  return isRecord(v) && typeof v.domainVerificationToken === \"string\" && v.domainVerificationToken.length > 0;\n}","typeGuard":"function isTokenPayload(v: unknown): v is { domainVerificationToken: string } {\n  return isRecord(v) && typeof v.domainVerificationToken === \"string\" && v.domainVerificationToken !== \"\";\n}","tryCatchPattern":"try {\n  await handleRequestDomainToken(domain);\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"verification token was missing\")) {\n    // surface: check domain registration / admin permission, then retry\n  } else throw e;\n}","preventionTips":["Ensure the domain is registered for the org before requesting a token","Verify the signed-in user has SSO admin rights","Keep Den API version matching the client's expected field names"],"tags":["sso","api","missing-field"],"backgroundTag":"missing-response-field","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}