{"record":{"id":"e5ec92dccdb55869","repo":"clockworklabs/SpacetimeDB","slug":"failed-to-get-jwt-payload-for-connection-id-conn","errorCode":null,"errorMessage":"Failed to get JWT payload for connection id ({connection_id}): {e}","messagePattern":"Failed to get JWT payload for connection id \\((.+?)\\): (.+?)","errorType":"exception","errorClass":"DatastoreError","httpStatus":null,"severity":"error","filePath":"crates/datastore/src/locking_tx_datastore/state_view.rs","lineNumber":329,"sourceCode":"    }\n\n    fn get_jwt_payload(&self, connection_id: ConnectionId) -> Result<Option<String>> {\n        log::trace!(\"Getting JWT payload for connection id: {}\", connection_id.to_hex());\n        let mut buf: Vec<u8> = Vec::new();\n        self.iter_by_col_eq(\n            ST_CONNECTION_CREDENTIALS_ID,\n            StConnectionCredentialsFields::ConnectionId,\n            &ConnectionIdViaU128::from(connection_id).into(),\n        )?\n            .next()\n            .map(|row| row.read_via_bsatn::<StConnectionCredentialsRow>(&mut buf).map(|r| r.jwt_payload))\n            .transpose()\n            .map_err(|e| {\n                log::error!(\n                    \"[{connection_id}]: get_jwt_payload: failed to get JWT payload for connection id ({connection_id}), error: {e}\"\n                );\n                DatastoreError::Other(\n                    anyhow!(\n                        \"Failed to get JWT payload for connection id ({connection_id}): {e}\"\n                    )\n                )\n            })\n    }\n}\n\n/// Returns an iterator over all `st_column` rows for `table_id`.\npub(crate) fn iter_st_column_for_table<'a>(\n    this: &'a (impl StateView + ?Sized),\n    table_id: &'a AlgebraicValue,\n) -> Result<impl 'a + Iterator<Item = RowRef<'a>>> {\n    this.iter_by_col_eq(ST_COLUMN_ID, StColumnFields::TableId, table_id)\n}\n\npub struct IterMutTx<'a> {\n    tx_state_ins: Option<(&'a Table, &'a HashMapBlobStore)>,\n    stage: ScanStage<'a>,","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/clockworklabs/SpacetimeDB/blob/6dee26c6efc2856793e12b148a59742964f5d783/crates/datastore/src/locking_tx_datastore/state_view.rs#L311-L347","documentation":"get_jwt_payload scans st_connection_credentials by connection_id and BSATN-decodes each matching row to extract jwt_payload. This error fires only when that read/decode step fails — a missing row returns Ok(None) instead — i.e. the stored credential row's bytes do not match the expected st_connection_credentials row shape (system-table schema drift or corrupted storage).","triggerScenarios":"Authentication code calling get_jwt_payload on a database whose st_connection_credentials rows were serialized by an incompatible spacetimedb version; corrupted pages holding the row; a system-table schema change shipped without a data migration.","commonSituations":"Upgrading spacetimedb across versions that changed system-table layouts while keeping the data directory; long-lived databases reopened after major upgrades; mixed-version replicas.","solutions":["Run the upgrade/migration path for the new version before serving connections","Re-authenticate connections so stale credential rows are rewritten in the current format","Verify the code path against a fresh database, then diff behavior against the upgraded one","Report the decode failure with the versions involved"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"Wrap get_jwt_payload calls; on this error log the connection_id (as the datastore already does), fail authentication for that connection with a server-error (not a rejected-credential) status, and alert operators — the credential store needs migration or repair. Ok(None) is the normal no-credentials path and must not be conflated with this error.","preventionTips":["Run the official upgrade/migration tooling before serving traffic on a new version","Re-authenticate clients after major upgrades so credential rows are rewritten in the current format","Alert on any st_* row decode failure — it signals schema drift, not a bad token"],"tags":["rust","spacetimedb","jwt","authentication","system-tables","deserialization"],"backgroundTag":"row-deserialization-failure","analyzedSha":"6dee26c6efc2856793e12b148a59742964f5d783","analyzedAt":"2026-08-20T06:08:37.179Z","contentChangedAt":"2026-08-20T06:08:37.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}