clockworklabs/SpacetimeDB · warning · anyhow::Error

No web session token

Error message

No web session token

What it means

Server-side logout invalidates the web session using the web session token stored in local config. If no web session token is stored for that host (never logged in via web login, already logged out, or the config was cleared), logout bails before making the request (logout.rs:33).

Source

Thrown at crates/cli/src/subcommands/logout.rs:33

pub async fn exec(mut config: Config, args: &ArgMatches) -> Result<(), anyhow::Error> {
    // Check if already logged out.
    if config.spacetimedb_token().is_none() && config.web_session_token().is_none() {
        println!("You are not logged in.");
        return Ok(());
    }

    let host: &String = args.get_one("auth-host").unwrap();
    let host = Url::parse(host)?;

    let _ = ensure_logged_out(&mut config, &host).await;

    Ok(())
}

async fn server_logout(config: &mut Config, host: &Url) -> Result<(), anyhow::Error> {
    let Some(web_session_token) = config.web_session_token() else {
        anyhow::bail!("No web session token");
    };
    // Best-effort server-side session invalidation.
    let client = reqwest::Client::builder().timeout(Duration::from_secs(5)).build()?;
    client
        .post(host.join("auth/cli/logout")?)
        .header("Authorization", format!("Bearer {web_session_token}"))
        .send()
        .await?;
    Ok(())
}

/// Logs out the user from the specified auth server.
/// Returns true if the user was logged out, false if they were not logged in.
pub async fn ensure_logged_out(config: &mut Config, host: &Url) -> bool {
    let Some(token) = config.spacetimedb_token() else {
        return false;
    };
    // Grab identity before clearing tokens.

View on GitHub (pinned to 524b4487d9)

Solutions

1. If the goal is just clearing local credentials, treat this as harmless — you are already logged out
2. Verify login state first with `spacetime login show`
3. Pass the same --auth-host that was used at login time
4. To actually exercise server-side logout: `spacetime login`, then `spacetime logout`

spacetime login show >/dev/null 2>&1 || {
  echo 'not logged in; nothing to log out' >&2; exit 0
}
spacetime logout

When it happens

Trigger: Running `spacetime logout` (optionally --auth-host <url>) when the config holds no web_session_token — e.g. running logout twice, or before ever running `spacetime login` against that host.

Common situations: Double logout in scripts; switching --auth-host values; credentials file deleted or reset; logging out on a machine where login used a pasted API token instead of web login.

Related errors

• Issuer too long: {:?}
• Subject too long: {:?}
• Issuer empty
• Subject empty
• Identity mismatch: token identity {token_identity:?} does no

AI-assisted analysis of clockworklabs/SpacetimeDB@524b4487d9 (2026-08-16). Data as JSON: /api/errors/8b7b916970eca02a. Report an issue: GitHub.