decolua/9router · error · Error

Invalid token format. Token appears too short.

Error message

Invalid token format. Token appears too short.

What it means

CursorService.validateImportToken() (src/lib/oauth/services/cursor.js:107) rejects imported access tokens shorter than 50 characters. Real Cursor access tokens are long opaque strings, so a short value almost certainly means the wrong value (or a truncated copy/paste) was taken from state.vscdb instead of the actual token.

Source

Thrown at src/lib/oauth/services/cursor.js:107

   * Validate and import token from Cursor IDE
   * Note: We skip API validation because Cursor API uses complex protobuf format.
   * Token will be validated when actually used for requests.
   * @param {string} accessToken - Access token from state.vscdb
   * @param {string} machineId - Machine ID from state.vscdb
   */
  async validateImportToken(accessToken, machineId) {
    // Basic validation
    if (!accessToken || typeof accessToken !== "string") {
      throw new Error("Access token is required");
    }

    if (!machineId || typeof machineId !== "string") {
      throw new Error("Machine ID is required");
    }

    // Token format validation (Cursor tokens are typically long strings)
    if (accessToken.length < 50) {
      throw new Error("Invalid token format. Token appears too short.");
    }

    // Machine ID format validation (should be UUID-like)
    const uuidRegex = /^[a-f0-9-]{32,}$/i;
    if (!uuidRegex.test(machineId.replace(/-/g, ""))) {
      throw new Error("Invalid machine ID format. Expected UUID format.");
    }

    // Note: We don't validate against API because Cursor uses complex protobuf.
    // Token will be validated when used for actual requests.

    return {
      accessToken,
      machineId,
      expiresIn: 86400, // Cursor tokens typically last 24 hours
      authMethod: "imported",
    };
  }

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Re-copy the full token from state.vscdb without truncation — quote it when copying out of the sqlite CLI output.
2. Verify length before calling: the raw cursorAuth/accessToken value is normally hundreds of characters.
3. Make sure you selected key='cursorAuth/accessToken' and not another itemTable row.
4. Log in to Cursor again if the stored token looks stale or malformed, then re-import.

Example fix

// before
await cursorService.validateImportToken(userInput.token.trim(), machineId);
// after
const token = String(userInput.token || "").trim();
if (token.length < 50) throw new Error(`Token looks truncated (${token.length} chars); re-copy cursorAuth/accessToken from state.vscdb`);
await cursorService.validateImportToken(token, machineId);

const token = String(rawToken || "").trim();
if (token.length < 50) {
  throw new Error(`Token appears truncated (${token.length} chars). Re-copy cursorAuth/accessToken from state.vscdb in full.`);
}

function looksLikeCursorToken(v) {
  return typeof v === "string" && v.length >= 50;
}

try {
  await cursorService.validateImportToken(token, machineId);
} catch (err) {
  if (/Token appears too short/.test(err.message)) {
    console.error("Re-copy the full token; terminal output often wraps/truncates long values.");
  } else throw err;
}

When it happens

Trigger: Calling validateImportToken with an accessToken string whose .length < 50 — e.g. pasting a truncated token, passing an API-key-like short value, submitting a placeholder like 'test', or reading the wrong itemTable row.

Common situations: Terminal/SQLite browser clipped the long token on copy; the user pasted a user ID or session prefix instead of the token; the sqlite CLI output included quoting that was stripped, leaving a fragment; very old Cursor versions stored a differently shaped token.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access token is required
• Machine ID is required
• Failed to import database
• Invalid database payload
• Invalid machine ID format. Expected UUID format.

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/9ed79867e4c3d728. Report an issue: GitHub.