{"record":{"id":"e9da0a506024e57b","repo":"anomalyco/sst","slug":"no-auth-resource-found-make-sure-to-link-the-auth","errorCode":null,"errorMessage":"No auth resource found. Make sure to link the auth resource to this function.","messagePattern":"No auth resource found\\. Make sure to link the auth resource to this function\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"sdk/js/src/auth/session.ts","lineNumber":26,"sourceCode":"  SessionTypes extends Record<string, any> = {},\n>() {\n  type SessionValue =\n    | {\n        [type in keyof SessionTypes]: {\n          type: type;\n          properties: SessionTypes[type];\n        };\n      }[keyof SessionTypes]\n    | {\n        type: \"public\";\n        properties: {};\n      };\n\n  return {\n    async verify(token: string): Promise<SessionValue> {\n      const auth = Object.values(Resource).find((value) => value.publicKey);\n      if (!auth) {\n        throw new Error(\n          \"No auth resource found. Make sure to link the auth resource to this function.\",\n        );\n      }\n      const publicKey = auth.publicKey;\n      const result = await jwtVerify(\n        token,\n        await importSPKI(publicKey, \"RS512\"),\n      );\n      return result.payload as any;\n    },\n    async create(session: SessionValue) {\n      const privateKey = await importPKCS8(\n        // @ts-expect-error\n        process.env.AUTH_PRIVATE_KEY || Resource.AUTH_PRIVATE_KEY,\n        \"RS512\",\n      );\n      const token = await new SignJWT(session)\n        .setProtectedHeader({ alg: \"RS512\" })","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/sdk/js/src/auth/session.ts#L8-L44","documentation":"`session.verify` runs in your deployed function and looks for a linked SST auth resource in the `Resource` object (any value with a `publicKey`). It uses that public key to verify the JWT. If no resource in `Resource` has a `publicKey`, the runtime cannot verify tokens, so it throws this error telling you to link the auth resource to the function.","triggerScenarios":"Calling `session.verify(token)` from a function that was deployed without a `link: [auth]` (or an auth resource reference) in its SST resource binding, so `Resource` contains no entry with a `publicKey` field.","commonSituations":"Forgetting `link: [auth]` when defining the API route/queue/bucket function in `sst.config.ts`; calling verify from a locally-run script outside `sst dev`; renaming the auth resource and dropping it from links; runtime SDK version mismatch where the link payload lacks publicKey.","solutions":["Add the auth resource to the function's `link` array in sst.config.ts (e.g. `link: [auth]`) and redeploy.","Reference the auth resource in the function so SST's linker includes it in the Resource object.","If running locally, use `sst dev` (or `sst shell`) so linked resources are injected.","Upgrade the SST runtime SDK if the deployed function bundle is stale."],"exampleFix":"// before: sst.config.ts\nnew sst.aws.Function(\"Api\", { handler: \"src/authorizer.handler\" })\n// after\nnew sst.aws.Function(\"Api\", {\n  handler: \"src/authorizer.handler\",\n  link: [auth],\n})","handlingStrategy":"validation","validationCode":"import { Resource } from \"sst\";\nif (!Object.values(Resource).some((v: any) => v?.publicKey)) {\n  throw new Error(\"Auth resource not linked. Add `link: [auth]` to this function in sst.config.ts and redeploy.\");\n}","typeGuard":"function hasLinkedAuth(resource: Record<string, unknown>): boolean {\n  return Object.values(resource).some((v) => typeof v === \"object\" && v !== null && \"publicKey\" in v);\n}","tryCatchPattern":"try {\n  const session = await session.verify(token);\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"No auth resource found\")) {\n    console.error(\"Deployment misconfiguration: link the auth resource to this function\");\n  }\n  throw e;\n}","preventionTips":["Always add `link: [auth]` to every function that verifies sessions.","Run verification code under `sst dev`/`sst shell` locally so resources are bound.","Grep for `session.verify` during code review and confirm each containing function has the auth link."],"tags":["auth","jwt","resource-linking","deployment"],"backgroundTag":"missing-linked-resource","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}