{"record":{"id":"f97e1c146a9bc679","repo":"cube-js/cube","slug":"no-app-secret-found","errorCode":null,"errorMessage":"No app secret found","messagePattern":"No app secret found","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-cli/src/command/token.ts","lineNumber":42,"sourceCode":"  expiry?: string;\n  secret?: string;\n  expiresIn?: string\n  payload: string[]\n  userContext: string[]\n};\n\nexport const token = async (options: TokenOptions) => {\n  event({\n    event: 'Generate Token'\n  });\n\n  const cubejsServer = requireFromPackage<any>('@cubejs-backend/server', {\n    relative: isDockerImage()\n  });\n  const { expiry = defaultExpiry, secret = cubejsServer.apiSecret() } = options;\n\n  if (!secret) {\n    throw new Error('No app secret found');\n  }\n\n  const extraOptions: Record<string, string> = {};\n\n  if (expiry !== '0') {\n    extraOptions.expiresIn = expiry;\n  }\n\n  const payload = {\n    ...parsePayload(options.payload),\n  };\n\n  console.log('Generating Cube JWT token');\n  console.log('');\n  console.log(`${chalk.yellow('-----------------------------------------------------------------------------------------')}`);\n  console.log(`  ${chalk.yellow('Use these manually generated tokens in production with caution.')}`);\n  console.log(`  ${chalk.yellow(`Please refer to ${chalk.cyan('https://cube.dev/docs/security')} for production security best practices.`)}`);\n  console.log(`${chalk.yellow('-----------------------------------------------------------------------------------------')}`);","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-cli/src/command/token.ts#L24-L60","documentation":"The `cubejs-cli token` command generates a JWT for the local dev app. It resolves the secret from the `--secret` option or, if absent, calls the bundled server's `apiSecret()` (which reads CUBEJS_API_SECRET or dev-mode .env). When neither yields a value, it throws 'No app secret found' because it cannot sign a token without a secret.","triggerScenarios":"Running `cubejs token` (or `yarn run cubejs-server token`) outside a project directory containing .env with CUBEJS_API_SECRET, without passing --secret, or in an environment where requireFromPackage cannot load @cubejs-backend/server's apiSecret.","commonSituations":"Running the CLI in a fresh shell where .env isn't loaded; generating a token for production where secrets are env-provided but the CLI runs elsewhere; CI environments with no CUBEJS_API_SECRET set.","solutions":["Pass the secret explicitly: `cubejs token --secret <your-app-secret>`","Run the command from the project root where .env defines CUBEJS_API_SECRET","Export CUBEJS_API_SECRET in the shell before invoking the CLI","If using the docker image context, ensure the server package is reachable (isDockerImage relative path resolution)"],"exampleFix":"// before\ncubejs token\n// after\ncubejs token --secret 0938f2c1...my-secret --expiry \"2 days\"","handlingStrategy":"validation","validationCode":"const secret = process.env.CUBEJS_API_SECRET;\nif (!secret && !options.secret) {\n  throw new Error('Set CUBEJS_API_SECRET or pass --secret before running: cubejs token');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run the CLI from the project root that has .env","Pass --secret explicitly in CI/scripts","Keep CUBEJS_API_SECRET exported in shells where you generate tokens"],"tags":["cli","jwt","configuration"],"backgroundTag":"missing-api-secret","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}