clockworklabs/SpacetimeDB · error · anyhow::Error

Session token is missing in response.

Error message

Session token is missing in response.

What it means

The auth server marked the login session approved (data.approved=true) but omitted the sessionToken field. Since an approved session must carry a token, the CLI treats this as a protocol violation and fails (login.rs:199).

Source

Thrown at crates/cli/src/subcommands/login.rs:199

impl WebLoginSessionResponse {
    fn approved(self) -> anyhow::Result<Option<WebLoginSessionResponseApproved>> {
        if !self.success {
            return Err(anyhow::anyhow!(self
                .error
                .clone()
                .unwrap_or("Unknown error".to_string())));
        }

        let data = self.data.ok_or(anyhow::anyhow!("Response data is missing."))?;
        if !data.approved {
            // Approved is false, no session token expected
            return Ok(None);
        }

        let session_token = data
            .session_token
            .ok_or(anyhow::anyhow!("Session token is missing in response.".to_string()))?;
        Ok(Some(WebLoginSessionResponseApproved {
            session_token: session_token.clone(),
        }))
    }
}

async fn web_login(remote: &Url, open_browser: bool) -> Result<String, anyhow::Error> {
    let client = reqwest::Client::new();

    let response: WebLoginTokenResponse = client
        .post(remote.join("/api/auth/cli/login/request-token")?)
        .send()
        .await?
        .error_for_status()?
        .json()
        .await?;

    if !response.success {

View on GitHub (pinned to 524b4487d9)

Solutions

1. Cancel and restart `spacetime login` end-to-end — a fresh request token usually resolves it
2. Update CLI and server to matching versions
3. If reproducible, inspect the response through a logging proxy and report it to SpacetimeDB

let out = Command::new("spacetime").args(["login"]).output()?;
let stderr = String::from_utf8_lossy(&out.stderr);
if !out.status.success() && stderr.contains("Session token is missing") {
    // restart the whole login flow; a fresh request token usually resolves it
}

When it happens

Trigger: Session polling response with approved=true and sessionToken missing or null, right after approving the login in the browser.

Common situations: Server race conditions at approval time; CLI/server version skew; proxies mangling camelCase JSON fields (sessionToken).

Related errors

• Response data is missing.
• Unknown error
• Failed to get token: {}
• Failed to request token
• unknown reducerId ${reducerId}

AI-assisted analysis of clockworklabs/SpacetimeDB@524b4487d9 (2026-08-16). Data as JSON: /api/errors/4c2bf9693ead79d3. Report an issue: GitHub.