different-ai/openwork · error

Failed to request domain verification (${response.status}).

Error message

Failed to request domain verification (${response.status}).

What it means

Thrown by handleRequestDomainToken when POST /v1/sso/request-domain-verification returns non-ok. This endpoint issues (or re-issues) a domainVerificationToken the org must publish as a DNS TXT record. After a successful request the token is extracted from payload.domainVerificationToken; a 2xx with missing/empty token throws a separate error, so this specific error is strictly an HTTP-level rejection.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx:255

    } catch (nextError) {
      setError(nextError instanceof Error ? nextError.message : "Failed to delete SSO settings.");
    }
  }

  async function handleRequestDomainToken() {
    if (!access.canManageSso) {
      setError("Only workspace owners and super-admins can request SSO domain verification tokens.");
      return;
    }
    if (!orgId || !connection) return;
    setError(null);
    try {
      await runReauthableAction("request-sso-domain-token", async () => {
        setRequestingDomainToken(true);
        try {
          const { response, payload } = await requestJson("/v1/sso/request-domain-verification", { method: "POST", headers: getOrgScopedHeaders(), body: JSON.stringify({}) }, 12000);
          if (!response.ok) {
            throw getRequestError(payload, response, `Failed to request domain verification (${response.status}).`);
          }

          const token = typeof (payload as { domainVerificationToken?: unknown } | null)?.domainVerificationToken === "string"
            ? (payload as { domainVerificationToken: string }).domainVerificationToken
            : "";
          if (!token) {
            throw new Error("SSO domain verification token was missing from the response.");
          }
          setDomainVerificationToken(token);
        } finally {
          setRequestingDomainToken(false);
        }
      });
    } catch (nextError) {
      setError(nextError instanceof Error ? nextError.message : "Failed to request domain verification.");
    }
  }

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Save the SSO connection first (handleSave) — most servers require an existing connection before issuing a domain token.
2. Read the appended server message; 409 with 'claimed' means another org owns the domain — choose another domain or contact support.
3. Handle ReauthRequiredError by re-authenticating, then retry.
4. Confirm the user has org admin rights and getOrgScopedHeaders() carries the right org.
5. Check DNS/verification state: if a token was already issued, reuse it instead of requesting a new one.

Example fix

// before: request token unconditionally
await requestDomainToken();
// after: require a saved connection first
if (!connection) {
  setError("Save the SSO connection before requesting domain verification.");
  return;
}
await runReauthableAction("request-sso-domain-token", requestDomainToken);

if (!connection) { setError("Save the SSO connection before requesting domain verification."); return; }
if (!domain) { setError("No domain configured for this connection."); return; }

function hasPendingToken(payload: unknown): payload is { domainVerificationToken: string } {
  return typeof payload === "object" && payload !== null
    && typeof (payload as { domainVerificationToken?: unknown }).domainVerificationToken === "string"
    && (payload as { domainVerificationToken: string }).domainVerificationToken.length > 0;
}

try {
  await requestDomainToken();
} catch (err) {
  if (isReauthRequiredError(err)) { promptSignIn(); return; }
  if (/\b409\b/.test(err.message)) { setError("Domain is already claimed or verification is in progress."); return; }
  setError(err.message);
}

When it happens

Trigger: POST /v1/sso/request-domain-verification with org-scoped headers and empty JSON body returns 400 (no verified connection saved yet, or domain field missing), 401 (expired session), 403 (not org admin / reauth challenge), 409 (verification already in progress or domain claimed by another org), 429, or 5xx. 12s timeout.

Common situations: Clicking 'request token' before saving the SSO connection; domain already verified/claimed by another organization; non-admin user; expired token in a long-open screen.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• Failed to verify domain (${response.status}).
• Could not resolve workspace SSO (${response.status}).
• Failed to load SSO settings (${response.status}).
• Failed to save SSO settings (${response.status}).
• Failed to delete SSO settings (${response.status}).

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/4089c73eb287bf15. Report an issue: GitHub.