{"record":{"id":"951d24276bc723b3","repo":"googleworkspace/cli","slug":"token-response-contained-no-access-token","errorCode":null,"errorMessage":"Token response contained no access token","messagePattern":"Token response contained no access token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/google-workspace-cli/src/auth.rs","lineNumber":273,"sourceCode":"                    &secret.client_secret,\n                    &secret.refresh_token,\n                )\n                .await;\n            }\n\n            // No proxy - use yup-oauth2 (faster, has token caching)\n            let auth = yup_oauth2::AuthorizedUserAuthenticator::builder(secret.clone())\n                .with_storage(Box::new(crate::token_storage::EncryptedTokenStorage::new(\n                    token_cache_path.to_path_buf(),\n                )))\n                .build()\n                .await\n                .context(\"Failed to build authorized user authenticator\")?;\n\n            let token = auth.token(scopes).await.context(\"Failed to get token\")?;\n            Ok(token\n                .token()\n                .ok_or_else(|| anyhow::anyhow!(\"Token response contained no access token\"))?\n                .to_string())\n        }\n        Credential::ServiceAccount(key) => {\n            let tc_filename = token_cache_path\n                .file_name()\n                .map(|f| f.to_string_lossy().to_string())\n                .unwrap_or_else(|| \"token_cache.json\".to_string());\n            let sa_cache = token_cache_path.with_file_name(format!(\"sa_{tc_filename}\"));\n            let builder = yup_oauth2::ServiceAccountAuthenticator::builder(key).with_storage(\n                Box::new(crate::token_storage::EncryptedTokenStorage::new(sa_cache)),\n            );\n\n            let auth = builder\n                .build()\n                .await\n                .context(\"Failed to build service account authenticator\")?;\n\n            let token = auth.token(scopes).await.context(\"Failed to get token\")?;","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/googleworkspace/cli/blob/a3768d0e82ad83cca2da97724e46bea4ff0e6dbd/crates/google-workspace-cli/src/auth.rs#L255-L291","documentation":"After yup_oauth2::AuthorizedUserAuthenticator (with EncryptedTokenStorage as its cache) returns from token(scopes), the code calls Token::token() to extract the access token string. This error fires when the token operation succeeded but the returned Token has no access_token set — i.e. a token object that exists yet carries no usable bearer credential. It is thrown by gws itself as an anyhow error, not by yup-oauth2.","triggerScenarios":"The encrypted token cache file decrypted to a structurally valid but semantically empty entry (no access_token field); yup-oauth2 returned an unauthenticated/error token because the cached refresh material is unusable; a yup-oauth2 version upgrade changed the cached Token shape so old cache data deserializes without the access_token.","commonSituations":"Token cache under ~/.config/gws restored from a backup of another machine or hand-edited; partial cache write from an old gws version; downgraded gws/yup-oauth2 reading a cache written by a newer version.","solutions":["Run `gws auth logout && gws auth login` — this clears and rebuilds the token cache","If logout fails, manually delete the token cache file (e.g. ~/.config/gws/token_cache.json) and log in again","Upgrade gws to the latest release so its cache schema matches the yup-oauth2 version in use"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match get_token(&scopes).await {\n    Ok(t) => { /* proceed */ }\n    Err(e) if e.to_string().contains(\"no access token\") => {\n        // treat cache as poisoned: clear token cache and force interactive re-login\n    }\n    Err(e) => { /* other auth failure */ }\n}","preventionTips":["Treat the gws token cache as disposable state — any anomaly, delete and re-login","Do not sync or hand-edit files under ~/.config/gws","Upgrade gws regularly so the yup-oauth2 cache format stays in sync"],"tags":["oauth","yup-oauth2","auth","token-cache"],"backgroundTag":"empty-oauth-access-token","analyzedSha":"a3768d0e82ad83cca2da97724e46bea4ff0e6dbd","analyzedAt":"2026-08-16T19:51:46.516Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}