{"record":{"id":"d3da65e5d4e888c3","repo":"clockworklabs/SpacetimeDB","slug":"internal-error-parsing-token","errorCode":null,"errorMessage":"Internal error parsing token","messagePattern":"Internal error parsing token","errorType":"http","errorClass":"AuthorizationRejection","httpStatus":401,"severity":"error","filePath":"crates/client-api/src/auth.rs","lineNumber":416,"sourceCode":"\npub struct SpacetimeAuthHeader {\n    auth: Option<SpacetimeAuth>,\n}\n\n#[async_trait::async_trait]\nimpl<S: NodeDelegate + Send + Sync> axum::extract::FromRequestParts<S> for SpacetimeAuthHeader {\n    type Rejection = AuthorizationRejection;\n    async fn from_request_parts(parts: &mut request::Parts, state: &S) -> Result<Self, Self::Rejection> {\n        let Some(creds) = SpacetimeCreds::from_request_parts(parts)? else {\n            return Ok(Self { auth: None });\n        };\n\n        let claims = validate_token(state, &creds.token)\n            .await\n            .map_err(AuthorizationRejection::Custom)?;\n\n        let payload = creds.extract_jwt_payload_string().ok_or_else(|| {\n            AuthorizationRejection::Custom(TokenValidationError::Other(anyhow!(\"Internal error parsing token\")))\n        })?;\n        let auth = SpacetimeAuth {\n            creds,\n            claims,\n            jwt_payload: payload.into(),\n        };\n        Ok(Self { auth: Some(auth) })\n    }\n}\n\n/// A response by the API signifying that an authorization was rejected with the `reason` for this.\n#[derive(Debug, derive_more::From)]\npub enum AuthorizationRejection {\n    Jwt(JwtError),\n    Header(headers::Error),\n    Custom(TokenValidationError),\n    Required,\n}","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/clockworklabs/SpacetimeDB/blob/524b4487d949b61a07d4f39c862d1290259dfd20/crates/client-api/src/auth.rs#L398-L434","documentation":"Server-side invariant failure in the SpacetimeDB HTTP API: validate_token accepted the bearer JWT, but re-splitting the same token to extract the raw payload string returned None. A token that just validated must split into three parts, so this error should be unreachable and indicates a server bug or an oddly-crafted token; the request is rejected via AuthorizationRejection.","triggerScenarios":"Any authenticated /v1 endpoint carrying a Bearer token where the manual payload split disagrees with the successful validation — practically limited to tokens whose separators normalize in unusual ways (e.g. non-ASCII dots) between the two reads.","commonSituations":"Almost never seen in practice; if it reproduces deterministically for a single token, that token string is malformed in an unusual way and should simply be regenerated.","solutions":["Log out and back in to mint a fresh token: `spacetime logout && spacetime login`.","Retry the request once with the new token.","If it reproduces, capture the server version and report the issue to SpacetimeDB (do not paste the token publicly)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await db.subscriptionBuilder().subscribe(...);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Internal error parsing token')) {\n    await reLoginAndRefreshToken(); // mint a fresh JWT and retry once\n    return retryOnce();\n  }\n  throw e;\n}","preventionTips":["Refresh tokens via re-login instead of persisting one token forever.","Do not mutate or re-encode token strings between requests.","Report deterministic reproductions upstream with the server version."],"tags":["spacetimedb","server","jwt","auth","internal-error"],"backgroundTag":"jwt-decode-failed","analyzedSha":"524b4487d949b61a07d4f39c862d1290259dfd20","analyzedAt":"2026-08-16T23:58:54.611Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}