{"record":{"id":"388b9013dac91564","repo":"hashicorp/nomad","slug":"token-name-too-long","errorCode":null,"errorMessage":"token name too long","messagePattern":"token name too long","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":762,"sourceCode":"\n\t// If both IDs are already set but no creation time was provided, the token\n\t// is being uploaded and the createTime should be set.\n\tif a.CreateTime.IsZero() {\n\t\ta.CreateTime = time.Now().UTC()\n\n\t\tif a.ExpirationTime == nil && a.ExpirationTTL != 0 {\n\t\t\ta.ExpirationTime = new(a.CreateTime.Add(a.ExpirationTTL))\n\t\t}\n\t}\n}\n\n// Validate is used to check a token for reasonableness\nfunc (a *ACLToken) Validate(minTTL, maxTTL time.Duration, existing *ACLToken) error {\n\tvar mErr multierror.Error\n\n\t// The human friendly name of an ACL token cannot exceed 256 characters.\n\tif len(a.Name) > maxTokenNameLength {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"token name too long\"))\n\t}\n\n\t// The type of an ACL token must be set. An ACL token of type client must\n\t// have associated policies or roles, whereas a management token cannot be\n\t// associated with policies.\n\tswitch a.Type {\n\tcase ACLClientToken:\n\t\tif len(a.Policies) == 0 && len(a.Roles) == 0 {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"client token missing policies or roles\"))\n\t\t}\n\tcase ACLManagementToken:\n\t\tif len(a.Policies) != 0 || len(a.Roles) != 0 {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"management token cannot be associated with policies or roles\"))\n\t\t}\n\tdefault:\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"token type must be client or management\"))\n\t}\n","sourceCodeStart":744,"sourceCodeEnd":780,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L744-L780","documentation":"A validation error produced by ACLToken.Validate. Nomad caps the human-friendly ACL token Name at maxTokenNameLength (256 characters); exceeding it appends this error to the multierror that rejects the token create/update.","triggerScenarios":"Calling ACL Upsert (token create or update) with an ACLToken whose Name exceeds 256 characters.","commonSituations":"Automation generating token names from long labels, UUID+description concatenations, or templated names that exceed the 256-char limit.","solutions":["Shorten the token name to 256 characters or fewer","Move descriptive metadata into the token's other fields or external tracking","Validate name length client-side before submitting the token"],"exampleFix":"// before\ntoken.Name = \"ci-deployer-\" + strings.Repeat(\"x\", 300)\n// after\nname := \"ci-deployer-\" + strings.Repeat(\"x\", 300)\ntoken.Name = name[:256] // or a shorter, meaningful name","handlingStrategy":"validation","validationCode":"if len(token.Name) > 256 {\n    return fmt.Errorf(\"token name must be at most 256 characters, got %d\", len(token.Name))\n}","typeGuard":"func validTokenName(name string) bool { return len(name) > 0 && len(name) <= 256 }","tryCatchPattern":"if err := token.Validate(minTTL, maxTTL, existing); err != nil {\n    if strings.Contains(err.Error(), \"token name too long\") {\n        token.Name = truncate(token.Name, 256)\n        err = token.Validate(minTTL, maxTTL, existing)\n    }\n}","preventionTips":["Truncate or slugify generated token names to <=256 chars","Keep descriptive metadata outside the Name field","Run Validate client-side before submitting token create/update"],"tags":["nomad","acl","token","validation"],"backgroundTag":"input-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}