{"record":{"id":"6aa8643259874ba5","repo":"mastra-ai/mastra","slug":"no-token-verification-method-configured","errorCode":null,"errorMessage":"No token verification method configured","messagePattern":"No token verification method configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"packages/server/src/server/auth/helpers.ts","lineNumber":392,"sourceCode":"\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (!requiresAuth && canAccessPublicly(path, method, authConfig)) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/auth/helpers.ts#L374-L410","documentation":"The core auth middleware verifies the request's bearer token via authConfig.authenticateToken. If no `authenticateToken` function is configured on the auth config, there is no way to verify tokens, so middleware throws this error (resulting in an auth failure response).","triggerScenarios":"A request hits an authenticated route while the server's auth configuration object lacks a `authenticateToken` function — e.g. passing only `authorizeUser`/session options, or passing an auth config of the wrong shape.","commonSituations":"Upgrading @mastra/core/server where auth config shape changed, copying an auth config snippet that only includes authorization rules, forgetting to wire the token verifier in a custom JWT/OAuth setup, or exporting the wrong object from the auth config module.","solutions":["Provide `authenticateToken: async (token, request) => { ...verify and return user... }` in your auth config","If using sessions/JWT from a provider, use the built-in auth config helper that wires authenticateToken for you","Log/inspect the resolved authConfig at startup to confirm authenticateToken is a function","Check version migration notes — older `verifyToken` style options must be migrated to authenticateToken"],"exampleFix":"// before\nexport const authConfig = { authorizeUser: async u => u }\n// after\nexport const authConfig = {\n  authenticateToken: async (token, req) => verifyJwt(token),\n  authorizeUser: async u => u,\n}","handlingStrategy":"validation","validationCode":"function assertAuthConfig(cfg: unknown): asserts cfg is { authenticateToken: Function } {\n  const c = cfg as Record<string, unknown>;\n  if (typeof c?.authenticateToken !== 'function') {\n    throw new Error('authConfig.authenticateToken must be a function');\n  }\n}\n// call at server startup: assertAuthConfig(authConfig);","typeGuard":"const hasTokenVerifier = (cfg: unknown): cfg is { authenticateToken: (t: string, r: Request) => Promise<unknown> } =>\n  typeof (cfg as { authenticateToken?: unknown })?.authenticateToken === 'function';","tryCatchPattern":"try {\n  await authorizeRequest(req);\n} catch (err) {\n  if (err instanceof Error && err.message === 'No token verification method configured') {\n    logger.error('Server auth misconfigured: authenticateToken missing');\n    return new Response('Auth misconfigured', { status: 500 });\n  }\n  return new Response('Unauthorized', { status: 401 });\n}","preventionTips":["Assert the auth config shape at server boot, before serving traffic","After upgrading, diff your auth config against current docs for renamed options","Export a single typed auth config constant and test it in unit tests"],"tags":["auth","configuration","jwt","middleware"],"backgroundTag":"missing-auth-config","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}