{"record":{"id":"4089c73eb287bf15","repo":"different-ai/openwork","slug":"failed-to-request-domain-verification-response","errorCode":null,"errorMessage":"Failed to request domain verification (${response.status}).","messagePattern":"Failed to request domain verification \\((.+?)\\)\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx","lineNumber":255,"sourceCode":"    } catch (nextError) {\n      setError(nextError instanceof Error ? nextError.message : \"Failed to delete SSO settings.\");\n    }\n  }\n\n  async function handleRequestDomainToken() {\n    if (!access.canManageSso) {\n      setError(\"Only workspace owners and super-admins can request SSO domain verification tokens.\");\n      return;\n    }\n    if (!orgId || !connection) return;\n    setError(null);\n    try {\n      await runReauthableAction(\"request-sso-domain-token\", async () => {\n        setRequestingDomainToken(true);\n        try {\n          const { response, payload } = await requestJson(\"/v1/sso/request-domain-verification\", { method: \"POST\", headers: getOrgScopedHeaders(), body: JSON.stringify({}) }, 12000);\n          if (!response.ok) {\n            throw getRequestError(payload, response, `Failed to request domain verification (${response.status}).`);\n          }\n\n          const token = typeof (payload as { domainVerificationToken?: unknown } | null)?.domainVerificationToken === \"string\"\n            ? (payload as { domainVerificationToken: string }).domainVerificationToken\n            : \"\";\n          if (!token) {\n            throw new Error(\"SSO domain verification token was missing from the response.\");\n          }\n          setDomainVerificationToken(token);\n        } finally {\n          setRequestingDomainToken(false);\n        }\n      });\n    } catch (nextError) {\n      setError(nextError instanceof Error ? nextError.message : \"Failed to request domain verification.\");\n    }\n  }\n","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx#L237-L273","documentation":"Thrown by handleRequestDomainToken when POST /v1/sso/request-domain-verification returns non-ok. This endpoint issues (or re-issues) a domainVerificationToken the org must publish as a DNS TXT record. After a successful request the token is extracted from payload.domainVerificationToken; a 2xx with missing/empty token throws a separate error, so this specific error is strictly an HTTP-level rejection.","triggerScenarios":"POST /v1/sso/request-domain-verification with org-scoped headers and empty JSON body returns 400 (no verified connection saved yet, or domain field missing), 401 (expired session), 403 (not org admin / reauth challenge), 409 (verification already in progress or domain claimed by another org), 429, or 5xx. 12s timeout.","commonSituations":"Clicking 'request token' before saving the SSO connection; domain already verified/claimed by another organization; non-admin user; expired token in a long-open screen.","solutions":["Save the SSO connection first (handleSave) — most servers require an existing connection before issuing a domain token.","Read the appended server message; 409 with 'claimed' means another org owns the domain — choose another domain or contact support.","Handle ReauthRequiredError by re-authenticating, then retry.","Confirm the user has org admin rights and getOrgScopedHeaders() carries the right org.","Check DNS/verification state: if a token was already issued, reuse it instead of requesting a new one."],"exampleFix":"// before: request token unconditionally\nawait requestDomainToken();\n// after: require a saved connection first\nif (!connection) {\n  setError(\"Save the SSO connection before requesting domain verification.\");\n  return;\n}\nawait runReauthableAction(\"request-sso-domain-token\", requestDomainToken);","handlingStrategy":"validation","validationCode":"if (!connection) { setError(\"Save the SSO connection before requesting domain verification.\"); return; }\nif (!domain) { setError(\"No domain configured for this connection.\"); return; }","typeGuard":"function hasPendingToken(payload: unknown): payload is { domainVerificationToken: string } {\n  return typeof payload === \"object\" && payload !== null\n    && typeof (payload as { domainVerificationToken?: unknown }).domainVerificationToken === \"string\"\n    && (payload as { domainVerificationToken: string }).domainVerificationToken.length > 0;\n}","tryCatchPattern":"try {\n  await requestDomainToken();\n} catch (err) {\n  if (isReauthRequiredError(err)) { promptSignIn(); return; }\n  if (/\\b409\\b/.test(err.message)) { setError(\"Domain is already claimed or verification is in progress.\"); return; }\n  setError(err.message);\n}","preventionTips":["Require a saved connection before enabling the 'request verification token' button.","Reuse an existing displayed token instead of re-requesting when one is already pending.","Check 409 messages for domain-claimed conflicts and surface them distinctly.","Ensure the user is an org admin to avoid predictable 403s.","Validate the returned token non-empty before rendering DNS instructions (the handler already does)."],"tags":["http","sso","dns","domain-verification","den-web"],"backgroundTag":"http-request-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}