{"record":{"id":"db6244583ec5439c","repo":"nextauthjs/next-auth","slug":"must-pass-req-to-jwt-gettoken","errorCode":null,"errorMessage":"Must pass `req` to JWT getToken()","messagePattern":"Must pass `req` to JWT getToken\\(\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/jwt.ts","lineNumber":161,"sourceCode":" */\nexport async function getToken<R extends boolean = false>(\n  params: GetTokenParams<R>\n): Promise<R extends true ? string : JWT | null>\nexport async function getToken(\n  params: GetTokenParams\n): Promise<string | JWT | null> {\n  const {\n    secureCookie,\n    cookieName = defaultCookies(secureCookie ?? false).sessionToken.name,\n    decode: _decode = decode,\n    salt = cookieName,\n    secret,\n    logger = console,\n    raw,\n    req,\n  } = params\n\n  if (!req) throw new Error(\"Must pass `req` to JWT getToken()\")\n\n  const headers =\n    req.headers instanceof Headers ? req.headers : new Headers(req.headers)\n\n  const sessionStore = new SessionStore(\n    { name: cookieName, options: { secure: secureCookie } },\n    parseCookie(headers.get(\"cookie\") ?? \"\"),\n    logger\n  )\n\n  let token = sessionStore.value\n\n  const authorizationHeader = headers.get(\"authorization\")\n\n  if (!token && authorizationHeader?.split(\" \")[0] === \"Bearer\") {\n    const urlEncodedToken = authorizationHeader.split(\" \")[1]\n    try {\n      token = decodeURIComponent(urlEncodedToken)","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/jwt.ts#L143-L179","documentation":"getToken() (the JWT module's helper for reading a session token outside route handlers) requires a `req` object to locate the token cookie or Authorization header. If params.req is missing, it throws immediately. Auth.js derives request info — headers, cookies, secure-cookie context — entirely from req, so it cannot proceed without it.","triggerScenarios":"Calling getToken({ secret }) without req; passing a NextApiRequest-like object where req was destructured away; invoking getToken in middleware/edge code with only the cookie string instead of a request; upgrading versions where the API contract changed to require req.","commonSituations":"Reading the session in a standalone API route or getServerSideProps and forgetting to pass req; passing res instead of req; custom server code calling getToken directly; examples copied from old docs (some versions accepted req OR token cookies differently).","solutions":["Pass the incoming request object: getToken({ req, secret, ... })","In App Router, construct req-compatible params or use auth()/getServerSession instead of getToken","In middleware, pass the NextRequest as req","If you only have a token string, decode with jwtDecode/decode directly instead of getToken"],"exampleFix":"// before\nconst token = await getToken({ secret: process.env.AUTH_SECRET })\n// after\nimport { getToken } from 'next-auth/jwt'\nconst token = await getToken({ req, secret: process.env.AUTH_SECRET })","handlingStrategy":"validation","validationCode":"if (!req) throw new Error('getToken requires req — pass the incoming request')\nconst token = await getToken({ req, secret: process.env.AUTH_SECRET })","typeGuard":"function hasReq(p: { req?: unknown }): p is { req: Request | { headers: Record<string, string> } } {\n  return p.req != null\n}","tryCatchPattern":"try {\n  const token = await getToken({ req, secret })\n  return token\n} catch (e) {\n  if (e.message.includes('Must pass `req`')) {\n    console.error('getToken called without req — pass the request object')\n  }\n  throw e\n}","preventionTips":["Always pass req (NextRequest/NextApiRequest) to getToken","In App Router, prefer auth()/getServerSession over getToken where possible","Only have a raw token string? Use decode/jwtDecode instead of getToken"],"tags":["jwt","nextjs","api-usage"],"backgroundTag":"missing-required-parameter","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}