{"record":{"id":"60c0761d6e0ba428","repo":"BoundaryML/baml","slug":"base64-decode-error-0","errorCode":null,"errorMessage":"Base64 decode error: {0}","messagePattern":"Base64 decode error: (.+?)","errorType":"exception","errorClass":"JwtError","httpStatus":null,"severity":"error","filePath":"engine/baml-runtime/src/internal/wasm_jwt.rs","lineNumber":27,"sourceCode":"/// At the time of writing, the Vertex provider is the only code in the\n/// runtime that produces JWT's.\nuse base64::{\n    engine::general_purpose::{STANDARD, URL_SAFE_NO_PAD},\n    Engine,\n};\nuse js_sys::{Array, Object, Uint8Array};\nuse serde::{Deserialize, Serialize};\nuse serde_json::json;\nuse thiserror::Error;\nuse wasm_bindgen::JsValue;\nuse wasm_bindgen_futures::JsFuture;\nuse web_sys::{window, CryptoKey, SubtleCrypto};\n\n#[derive(Error, Debug)]\npub enum JwtError {\n    #[error(\"JavaScript error: {0:?}\")]\n    JsError(JsValue),\n    #[error(\"Base64 decode error: {0}\")]\n    Base64Error(#[from] base64::DecodeError),\n    #[error(\"JSON error: {0}\")]\n    JsonError(#[from] serde_json::Error),\n    #[error(\"Missing window object\")]\n    NoWindow,\n    #[error(\"Missing crypto API\")]\n    NoCrypto,\n}\n\nimpl From<JsValue> for JwtError {\n    fn from(err: JsValue) -> Self {\n        JwtError::JsError(err)\n    }\n}\n\npub async fn encode_jwt(\n    claims: &serde_json::Value,\n    private_key_pem: &str,","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/engine/baml-runtime/src/internal/wasm_jwt.rs#L9-L45","documentation":"JwtError::Base64Error converts a base64::DecodeError (via #[from]) when decoding base64 material — typically the JWT header/payload segments or key data — fails because the input is not valid base64. Raised while parsing parts of a JWT inside the wasm JWT helper.","triggerScenarios":"Passing a malformed or truncated JWT string to the decoder; base64url segments containing illegal characters; a key or token fetched from an API that is not actually base64.","commonSituations":"Copy-pasted JWT with missing padding or whitespace/newlines; error HTML/JSON response stored in the token variable; manually trimmed token cut mid-segment; confusing base64url with standard base64.","solutions":["Validate the token has three dot-separated base64url segments before decoding.","Use a base64url decoder configuration (URL_SAFE_NO_PAD) matching JWT encoding.","Trim whitespace and newlines from the token string before decoding.","Check where the token comes from — an error response body may be what's being decoded."],"exampleFix":"// before\nbase64::decode(segment)?\n// after\nbase64::engine::general_purpose::URL_SAFE_NO_PAD.decode(segment.trim())?","handlingStrategy":"validation","validationCode":"const isJwtShape = (t) => /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*$/.test(t.trim());\nif (!isJwtShape(token)) throw new Error(\"Not a valid JWT shape\");","typeGuard":"function isJwt(value) {\n  return typeof value === \"string\" && value.trim().split(\".\").length === 3;\n}","tryCatchPattern":"match decode_token(token) {\n    Ok(decoded) => Ok(decoded),\n    Err(JwtError::Base64Error(e)) => {\n        eprintln!(\"Token is not valid base64url: {}\", e);\n        Err(JwtError::Base64Error(e))\n    }\n    Err(other) => Err(other),\n}","preventionTips":["Trim whitespace/newlines from tokens before decoding.","Use base64url (URL_SAFE_NO_PAD) decoding for JWT segments.","Never feed error-response bodies into JWT decoding paths."],"tags":["wasm","base64","jwt","decoding"],"backgroundTag":"invalid-argument-format","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}