clockworklabs/SpacetimeDB · error · AuthorizationRejection

Internal error parsing token

Error message

Internal error parsing token

What it means

Server-side invariant failure in the SpacetimeDB HTTP API: validate_token accepted the bearer JWT, but re-splitting the same token to extract the raw payload string returned None. A token that just validated must split into three parts, so this error should be unreachable and indicates a server bug or an oddly-crafted token; the request is rejected via AuthorizationRejection.

Source

Thrown at crates/client-api/src/auth.rs:416

pub struct SpacetimeAuthHeader {
    auth: Option<SpacetimeAuth>,
}

#[async_trait::async_trait]
impl<S: NodeDelegate + Send + Sync> axum::extract::FromRequestParts<S> for SpacetimeAuthHeader {
    type Rejection = AuthorizationRejection;
    async fn from_request_parts(parts: &mut request::Parts, state: &S) -> Result<Self, Self::Rejection> {
        let Some(creds) = SpacetimeCreds::from_request_parts(parts)? else {
            return Ok(Self { auth: None });
        };

        let claims = validate_token(state, &creds.token)
            .await
            .map_err(AuthorizationRejection::Custom)?;

        let payload = creds.extract_jwt_payload_string().ok_or_else(|| {
            AuthorizationRejection::Custom(TokenValidationError::Other(anyhow!("Internal error parsing token")))
        })?;
        let auth = SpacetimeAuth {
            creds,
            claims,
            jwt_payload: payload.into(),
        };
        Ok(Self { auth: Some(auth) })
    }
}

/// A response by the API signifying that an authorization was rejected with the `reason` for this.
#[derive(Debug, derive_more::From)]
pub enum AuthorizationRejection {
    Jwt(JwtError),
    Header(headers::Error),
    Custom(TokenValidationError),
    Required,
}

View on GitHub (pinned to 524b4487d9)

Solutions

1. Log out and back in to mint a fresh token: `spacetime logout && spacetime login`.
2. Retry the request once with the new token.
3. If it reproduces, capture the server version and report the issue to SpacetimeDB (do not paste the token publicly).

try {
  await db.subscriptionBuilder().subscribe(...);
} catch (e) {
  if (e instanceof Error && e.message.includes('Internal error parsing token')) {
    await reLoginAndRefreshToken(); // mint a fresh JWT and retry once
    return retryOnce();
  }
  throw e;
}

When it happens

Trigger: Any authenticated /v1 endpoint carrying a Bearer token where the manual payload split disagrees with the successful validation — practically limited to tokens whose separators normalize in unusual ways (e.g. non-ASCII dots) between the two reads.

Common situations: Almost never seen in practice; if it reproduces deterministically for a single token, that token string is malformed in an unusual way and should simply be regenerated.

Related errors

• Unable to read public key for JWT token verification
• Issuer too long: {:?}
• Subject too long: {:?}
• Issuer empty
• Subject empty

AI-assisted analysis of clockworklabs/SpacetimeDB@524b4487d9 (2026-08-16). Data as JSON: /api/errors/d3da65e5d4e888c3. Report an issue: GitHub.