{"record":{"id":"4c2bf9693ead79d3","repo":"clockworklabs/SpacetimeDB","slug":"session-token-is-missing-in-response","errorCode":null,"errorMessage":"Session token is missing in response.","messagePattern":"Session token is missing in response\\.","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/cli/src/subcommands/login.rs","lineNumber":199,"sourceCode":"\nimpl WebLoginSessionResponse {\n    fn approved(self) -> anyhow::Result<Option<WebLoginSessionResponseApproved>> {\n        if !self.success {\n            return Err(anyhow::anyhow!(self\n                .error\n                .clone()\n                .unwrap_or(\"Unknown error\".to_string())));\n        }\n\n        let data = self.data.ok_or(anyhow::anyhow!(\"Response data is missing.\"))?;\n        if !data.approved {\n            // Approved is false, no session token expected\n            return Ok(None);\n        }\n\n        let session_token = data\n            .session_token\n            .ok_or(anyhow::anyhow!(\"Session token is missing in response.\".to_string()))?;\n        Ok(Some(WebLoginSessionResponseApproved {\n            session_token: session_token.clone(),\n        }))\n    }\n}\n\nasync fn web_login(remote: &Url, open_browser: bool) -> Result<String, anyhow::Error> {\n    let client = reqwest::Client::new();\n\n    let response: WebLoginTokenResponse = client\n        .post(remote.join(\"/api/auth/cli/login/request-token\")?)\n        .send()\n        .await?\n        .error_for_status()?\n        .json()\n        .await?;\n\n    if !response.success {","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/clockworklabs/SpacetimeDB/blob/524b4487d949b61a07d4f39c862d1290259dfd20/crates/cli/src/subcommands/login.rs#L181-L217","documentation":"The auth server marked the login session approved (data.approved=true) but omitted the sessionToken field. Since an approved session must carry a token, the CLI treats this as a protocol violation and fails (login.rs:199).","triggerScenarios":"Session polling response with approved=true and sessionToken missing or null, right after approving the login in the browser.","commonSituations":"Server race conditions at approval time; CLI/server version skew; proxies mangling camelCase JSON fields (sessionToken).","solutions":["Cancel and restart `spacetime login` end-to-end — a fresh request token usually resolves it","Update CLI and server to matching versions","If reproducible, inspect the response through a logging proxy and report it to SpacetimeDB"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"let out = Command::new(\"spacetime\").args([\"login\"]).output()?;\nlet stderr = String::from_utf8_lossy(&out.stderr);\nif !out.status.success() && stderr.contains(\"Session token is missing\") {\n    // restart the whole login flow; a fresh request token usually resolves it\n}","preventionTips":["Complete the browser approval step promptly after starting login","Restart the login flow rather than reusing a stuck session","Keep CLI and server versions in sync"],"tags":["login","auth","schema-mismatch","web-login"],"backgroundTag":"auth-response-schema-mismatch","analyzedSha":"524b4487d949b61a07d4f39c862d1290259dfd20","analyzedAt":"2026-08-16T23:58:54.611Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}