cube-js/cube · error · Error

No app secret found

Error message

No app secret found

What it means

The `cubejs-cli token` command generates a JWT for the local dev app. It resolves the secret from the `--secret` option or, if absent, calls the bundled server's `apiSecret()` (which reads CUBEJS_API_SECRET or dev-mode .env). When neither yields a value, it throws 'No app secret found' because it cannot sign a token without a secret.

Source

Thrown at packages/cubejs-cli/src/command/token.ts:42

  expiry?: string;
  secret?: string;
  expiresIn?: string
  payload: string[]
  userContext: string[]
};

export const token = async (options: TokenOptions) => {
  event({
    event: 'Generate Token'
  });

  const cubejsServer = requireFromPackage<any>('@cubejs-backend/server', {
    relative: isDockerImage()
  });
  const { expiry = defaultExpiry, secret = cubejsServer.apiSecret() } = options;

  if (!secret) {
    throw new Error('No app secret found');
  }

  const extraOptions: Record<string, string> = {};

  if (expiry !== '0') {
    extraOptions.expiresIn = expiry;
  }

  const payload = {
    ...parsePayload(options.payload),
  };

  console.log('Generating Cube JWT token');
  console.log('');
  console.log(`${chalk.yellow('-----------------------------------------------------------------------------------------')}`);
  console.log(`  ${chalk.yellow('Use these manually generated tokens in production with caution.')}`);
  console.log(`  ${chalk.yellow(`Please refer to ${chalk.cyan('https://cube.dev/docs/security')} for production security best practices.`)}`);
  console.log(`${chalk.yellow('-----------------------------------------------------------------------------------------')}`);

View on GitHub (pinned to 7d981676b3)

Solutions

1. Pass the secret explicitly: `cubejs token --secret <your-app-secret>`
2. Run the command from the project root where .env defines CUBEJS_API_SECRET
3. Export CUBEJS_API_SECRET in the shell before invoking the CLI
4. If using the docker image context, ensure the server package is reachable (isDockerImage relative path resolution)

Example fix

// before
cubejs token
// after
cubejs token --secret 0938f2c1...my-secret --expiry "2 days"

const secret = process.env.CUBEJS_API_SECRET;
if (!secret && !options.secret) {
  throw new Error('Set CUBEJS_API_SECRET or pass --secret before running: cubejs token');
}

When it happens

Trigger: Running `cubejs token` (or `yarn run cubejs-server token`) outside a project directory containing .env with CUBEJS_API_SECRET, without passing --secret, or in an environment where requireFromPackage cannot load @cubejs-backend/server's apiSecret.

Common situations: Running the CLI in a fresh shell where .env isn't loaded; generating a token for production where secrets are env-provided but the CLI runs elsewhere; CI environments with no CUBEJS_API_SECRET set.

Related errors

• Live-preview token is invalid
• API URL is empty
• context `{name}` not found (run `cube login --name {name}`)
• Unable to decode JWT key
• JWT without kid inside headers

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/f97e1c146a9bc679. Report an issue: GitHub.