{"record":{"id":"c677f163b6b96e91","repo":"paperclipai/paperclip","slug":"challenge-secret-is-required-pass-token-or-to","errorCode":null,"errorMessage":"Challenge secret is required. Pass --token or --token-env.","messagePattern":"Challenge secret is required\\. Pass --token or --token-env\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/client/auth.ts","lineNumber":202,"sourceCode":"        }),\n    );\n  }\n}\n\nfunction parseJson(value: string): unknown {\n  return JSON.parse(value) as unknown;\n}\n\nfunction resolveChallengeToken(opts: AuthChallengeOptions): string {\n  const token = opts.token?.trim();\n  if (token) return token;\n  const envName = opts.tokenEnv?.trim();\n  if (envName) {\n    const envValue = process.env[envName]?.trim();\n    if (envValue) return envValue;\n    throw new Error(`Environment variable ${envName} is empty or not set.`);\n  }\n  throw new Error(\"Challenge secret is required. Pass --token or --token-env.\");\n}\n","sourceCodeStart":184,"sourceCodeEnd":204,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/cli/src/commands/client/auth.ts#L184-L204","documentation":"Thrown by resolveChallengeToken() when neither --token nor --token-env was supplied (or both are empty). This is the auth-challenge command's hard requirement: a challenge secret must come from one of those two sources. Reached only when both paths are absent (if --token-env is given but empty, [15] fires instead).","triggerScenarios":"Running `paperclipai auth challenge ...` with neither --token nor --token-env. Both flags supplied empty. The command needs the shared challenge secret to mint/approve a cli-auth challenge.","commonSituations":"User assumed the secret would be picked up from a default env var. Forgot to pass either flag. Help text not read.","solutions":["Pass --token directly: `paperclipai auth challenge --token <secret>`.","Or point to an env var: `--token-env MY_VAR` after exporting it.","Confirm the secret value matches what the server/operator expects for the challenge."],"exampleFix":"// before\npaperclipai auth challenge --client-name my-cli\n// after\npaperclipai auth challenge --client-name my-cli --token $CHALLENGE_SECRET","handlingStrategy":"validation","validationCode":"function requireChallengeToken(opts: { token?: string; tokenEnv?: string }): string {\n  if (opts.token?.trim()) return opts.token.trim();\n  if (opts.tokenEnv?.trim()) { /* caller resolves env */ throw new Error('use --token-env path'); }\n  throw new Error('Challenge secret required. Pass --token <secret> or --token-env <NAME>.');\n}","typeGuard":null,"tryCatchPattern":"try { resolveChallengeToken(opts); }\ncatch (err) {\n  const msg = err instanceof Error ? err.message : '';\n  if (msg === 'Challenge secret is required. Pass --token or --token-env.') {\n    console.error(msg); process.exit(2);\n  }\n  throw err;\n}","preventionTips":["Always pass exactly one of --token / --token-env for auth challenge.","Document the expected secret source in your runbook.","Fail fast in wrappers: assert one of the two is set before invoking the CLI."],"tags":["cli","auth","validation","secrets","usage"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}