{"record":{"id":"cfac5b69bca9a741","repo":"dotnet/aspnetcore","slug":"failed-to-retrieve-token-no-account-found","errorCode":null,"errorMessage":"Failed to retrieve token, no account found.","messagePattern":"Failed to retrieve token, no account found\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/Components/WebAssembly/Authentication.Msal/src/Interop/AuthenticationService.ts","lineNumber":191,"sourceCode":"    async getAccessToken(request?: AccessTokenRequestOptions): Promise<AccessTokenResult> {\n        try {\n            this.trace('getAccessToken', request);\n            const newToken = await this.getTokenCore(request?.scopes);\n            return {\n                status: AccessTokenResultStatus.Success,\n                token: newToken\n            };\n        } catch (e) {\n            return {\n                status: AccessTokenResultStatus.RequiresRedirect\n            };\n        }\n    }\n\n    async getTokenCore(scopes?: string[]): Promise<AccessToken | undefined> {\n        const account = this.getAccount();\n        if (!account) {\n            throw new Error('Failed to retrieve token, no account found.');\n        }\n\n        const silentRequest = {\n            redirectUri: this._settings.auth?.redirectUri,\n            account: account,\n            scopes: scopes || this._settings.defaultAccessTokenScopes\n        };\n\n        this.debug(`Provisioning a token silently for scopes '${silentRequest.scopes}'`)\n        this.trace('_msalApplication.acquireTokenSilent', silentRequest);\n        const response = await this._msalApplication.acquireTokenSilent(silentRequest);\n        this.trace('_msalApplication.acquireTokenSilent-response', response);\n\n        if (response.scopes.length === 0 || response.accessToken === '') {\n            throw new Error('Scopes not granted.');\n        }\n\n        const result = {","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Components/WebAssembly/Authentication.Msal/src/Interop/AuthenticationService.ts#L173-L209","documentation":"Thrown by AuthenticationService.getTokenCore() in the MSAL interop (AuthenticationService.ts:191) when getAccount() returns null. Token acquisition requires a signed-in account to build the silent request; with no account in MSAL's cache (neither a stored _account nor any account from getAllAccounts()), the service cannot request a token and throws. The outer getAccessToken() wrapper catches this and converts it to a RequiresRedirect result.","triggerScenarios":"Calling getAccessToken()/getTokenCore() before the user has signed in, after sign-out cleared the account, after the MSAL cache expired/was cleared, or when the redirect/parse of the auth response failed so no account was established. Also when the configured authority/loginHint does not match any cached account.","commonSituations":"App boots and requests an access token before completing the sign-in flow. User cleared browser storage or the session expired. The MSAL redirect handling did not parse the URL hash into an account (wrong redirectUri, blocked third-party cookies/IFrame storage, or a failed silent SSO). Multiple tabs interfering with the MSAL cache.","solutions":["Trigger an interactive sign-in flow (signIn/redirect) before requesting access tokens — verify isAuthenticated first.","Ensure redirectUri in MSAL settings matches the registered application redirect exactly and that the hash is processed on return (handleRedirectPromise).","Check that third-party cookies / partitioned storage are not blocking MSAL's silent cache reads; fall back to interactive acquisition.","Call getAccessToken with appropriate interaction so the framework can prompt rather than fail silently."],"exampleFix":"// before\nconst token = await authService.getAccessToken({ scopes: ['api'] });\n\n// after\nif (!await authService.isAuthenticated()) {\n  await authService.signIn({ /* interaction */ });\n}\nconst token = await authService.getAccessToken({ scopes: ['api'] });","handlingStrategy":"try-catch","validationCode":"async function ensureAccount(authService: AuthenticationService): Promise<boolean> {\n  return Boolean(authService.getAccount());\n}","typeGuard":null,"tryCatchPattern":"try {\n  const token = await authService.getTokenCore(scopes);\n} catch (e) {\n  if (/no account found/i.test(e.message)) {\n    await authService.signIn({ ... }); // interactive sign-in\n  } else { throw e; }\n}","preventionTips":["Ensure sign-in completes before calling getAccessToken.","Handle the RequiresRedirect result from getAccessToken to trigger interactive sign-in.","Verify redirectUri matches the app registration.","Watch for third-party cookie / partitioned storage blocking silent SSO."],"tags":["authentication","msal","blazor","token","auth-session"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}