{"record":{"id":"c53037261868b1e9","repo":"RocketChat/Rocket.Chat","slug":"workspace-access-token-is-empty-c53037","errorCode":null,"errorMessage":"Workspace access token is empty","messagePattern":"Workspace access token is empty","errorType":"http","errorClass":"CloudWorkspaceAccessTokenEmptyError","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/cloud/syncWorkspace/syncCloudData.ts","lineNumber":22,"sourceCode":"import { fetchWorkspaceSyncPayload } from './fetchWorkspaceSyncPayload';\nimport { CloudWorkspaceAccessError } from '../../../../lib/errors/CloudWorkspaceAccessError';\nimport { CloudWorkspaceRegistrationError } from '../../../../lib/errors/CloudWorkspaceRegistrationError';\nimport { callbacks } from '../../callbacks';\nimport { SystemLogger } from '../../logger/system';\nimport { buildWorkspaceRegistrationData } from '../buildRegistrationData';\nimport { CloudWorkspaceAccessTokenEmptyError, getWorkspaceAccessToken } from '../getWorkspaceAccessToken';\nimport { retrieveRegistrationStatus } from '../retrieveRegistrationStatus';\n\nexport async function syncCloudData() {\n\ttry {\n\t\tconst { workspaceRegistered } = await retrieveRegistrationStatus();\n\t\tif (!workspaceRegistered) {\n\t\t\tthrow new CloudWorkspaceRegistrationError('Workspace is not registered');\n\t\t}\n\n\t\tconst token = await getWorkspaceAccessToken(true);\n\t\tif (!token) {\n\t\t\tthrow new CloudWorkspaceAccessTokenEmptyError();\n\t\t}\n\n\t\tconst workspaceRegistrationData = await buildWorkspaceRegistrationData(undefined);\n\n\t\tconst {\n\t\t\tlicense,\n\t\t\tremoveLicense = false,\n\t\t\tcloudSyncAnnouncement,\n\t\t} = await fetchWorkspaceSyncPayload({\n\t\t\ttoken,\n\t\t\tdata: workspaceRegistrationData,\n\t\t});\n\n\t\tawait Settings.updateValueById('Cloud_Sync_Announcement_Payload', JSON.stringify(cloudSyncAnnouncement ?? null));\n\n\t\tif (removeLicense) {\n\t\t\tawait callbacks.run('workspaceLicenseRemoved');\n\t\t} else {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/cloud/syncWorkspace/syncCloudData.ts#L4-L40","documentation":"Thrown by syncCloudData() when the workspace reports as registered with Rocket.Chat Cloud but getWorkspaceAccessToken(true) resolves to an empty string. getWorkspaceAccessToken returns '' when an offline license is active or when fetching a new token from Cloud fails in its non-throwing mode, so the sync run has no bearer token and aborts before building the registration payload.","triggerScenarios":"The periodic workspace sync (or a manual sync call) runs when retrieveRegistrationStatus() says registered, but the WorkspaceCredentials cache is empty/expired and the token request to Cloud fails silently, or License.hasOfflineLicense() makes getWorkspaceAccessToken return '' unconditionally.","commonSituations":"Offline license installed on a workspace that still carries cloud registration data; Cloud unreachable (firewall/DNS) so token renewal never succeeds; registration records partially present after a database restore or migration.","solutions":["If an offline license is intentional, remove the stale cloud registration data so retrieveRegistrationStatus no longer reports registered","Verify outbound HTTPS connectivity to Rocket.Chat Cloud from the server, then let the sync retry and fetch a fresh token","Re-register the workspace (Administration > Connectivity Services) so valid WorkspaceCredentials are stored","Check the WorkspaceCredentials collection and server logs for silent token-fetch failures if the issue persists"],"exampleFix":"// before\nconst token = await getWorkspaceAccessToken(true);\nif (!token) {\n  throw new CloudWorkspaceAccessTokenEmptyError();\n}\n\n// after: only sync when a token is actually obtainable, otherwise surface re-registration\nconst token = await getWorkspaceAccessToken(true);\nif (!token) {\n  await updateRegistrationStatus();\n  return; // skip this sync cycle instead of throwing","handlingStrategy":"validation","validationCode":"import { getWorkspaceAccessToken } from './getWorkspaceAccessToken';\nimport { retrieveRegistrationStatus } from './retrieveRegistrationStatus';\n\nconst { workspaceRegistered } = await retrieveRegistrationStatus();\nconst token = await getWorkspaceAccessToken(true);\nif (workspaceRegistered && !token) {\n  // skip the sync cycle and surface a re-registration prompt instead of throwing\n}","typeGuard":null,"tryCatchPattern":"try {\n  await syncCloudData();\n} catch (err) {\n  if (err instanceof CloudWorkspaceAccessTokenEmptyError) {\n    // token unobtainable: schedule re-registration, do not retry blindly\n    return;\n  }\n  throw err;\n}","preventionTips":["Complete the full Cloud registration/login flow so WorkspaceCredentials persist","Keep server egress to Cloud open so token renewal never silently fails","If running under an offline license, clear leftover cloud registration data"],"tags":["cloud","registration","access-token","sync"],"backgroundTag":"missing-access-token","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}