decolua/9router · error · Error

Access token is required

Error message

Access token is required

What it means

CursorService.validateImportToken() (src/lib/oauth/services/cursor.js:98) performs local-only validation of a token pair imported from Cursor IDE's state.vscdb SQLite database. This first guard fires when the accessToken argument is missing, empty, or not a string. No network call is made — it is pure input validation before the token is accepted.

Source

Thrown at src/lib/oauth/services/cursor.js:98

      const arch = process.arch;
      if (arch === "x64") return "x86_64";
      if (arch === "arm64") return "aarch64";
      return arch;
    }
    return "x86_64";
  }

  /**
   * Validate and import token from Cursor IDE
   * Note: We skip API validation because Cursor API uses complex protobuf format.
   * Token will be validated when actually used for requests.
   * @param {string} accessToken - Access token from state.vscdb
   * @param {string} machineId - Machine ID from state.vscdb
   */
  async validateImportToken(accessToken, machineId) {
    // Basic validation
    if (!accessToken || typeof accessToken !== "string") {
      throw new Error("Access token is required");
    }

    if (!machineId || typeof machineId !== "string") {
      throw new Error("Machine ID is required");
    }

    // Token format validation (Cursor tokens are typically long strings)
    if (accessToken.length < 50) {
      throw new Error("Invalid token format. Token appears too short.");
    }

    // Machine ID format validation (should be UUID-like)
    const uuidRegex = /^[a-f0-9-]{32,}$/i;
    if (!uuidRegex.test(machineId.replace(/-/g, ""))) {
      throw new Error("Invalid machine ID format. Expected UUID format.");
    }

    // Note: We don't validate against API because Cursor uses complex protobuf.

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Extract the token from state.vscdb with: sqlite3 state.vscdb "SELECT value FROM itemTable WHERE key='cursorAuth/accessToken'" and pass that exact string.
2. Log in to Cursor IDE first so the accessToken row exists, then re-import.
3. Coerce/check before calling: if (typeof token !== 'string' || !token) fix the extraction step.
4. If a driver returns a Buffer, call .toString('utf8') before passing it.

Example fix

// before
await cursorService.validateImportToken(row?.value, machineId);
// after
const token = typeof row?.value === "string" ? row.value : row?.value?.toString("utf8");
if (!token) throw new Error("cursorAuth/accessToken not found in state.vscdb — is Cursor logged in?");
await cursorService.validateImportToken(token, machineId);

const token = valueFromVscdb;
if (typeof token !== "string" || token.length === 0) {
  throw new Error("cursorAuth/accessToken missing — run: sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='cursorAuth/accessToken'\"");
}

function isNonEmptyString(v) {
  return typeof v === "string" && v.length > 0;
}

try {
  await cursorService.validateImportToken(token, machineId);
} catch (err) {
  if (err.message === "Access token is required") {
    console.error("No access token supplied. Confirm Cursor is logged in and the state.vscdb row exists.");
  } else throw err;
}

When it happens

Trigger: Calling validateImportToken(undefined | null | '' | non-string, machineId) — e.g. the sqlite query for key 'cursorAuth/accessToken' returned no row, the value was read as a Buffer/JSON object instead of a string, or the form field was submitted empty from the dashboard import UI.

Common situations: Cursor was never logged in so the DB row doesn't exist; the user pasted values into the wrong fields; a script read state.vscdb with sqlite3 and got NULL; reading the DB with a driver that returns Blobs which are not `typeof string`.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• Machine ID is required
• Invalid token format. Token appears too short.
• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/355c4b61624c3635. Report an issue: GitHub.