different-ai/openwork · error · DenApiError

invalid_worker_token_payload

invalid_worker_token_payload

Error message

Worker token response was missing token values.

What it means

getWorkerTokens POSTs to /v1/workers/:workerId/tokens and validates the payload with getWorkerTokens. If the response lacks the required token values, a 500 DenApiError with code "invalid_worker_token_payload" is thrown, guaranteeing callers receive complete DenWorkerTokens.

Source

Thrown at apps/app/src/app/lib/den.ts:3114

        body: { scopes: ["mcp:read", "mcp:write"] },
      });
      const minted = parseDenMcpToken(payload);
      if (!minted) {
        throw new DenApiError(500, "invalid_mcp_token_payload", "MCP token response was missing required values.");
      }
      return minted;
    },

    async getWorkerTokens(workerId: string, orgId: string): Promise<DenWorkerTokens> {
      const payload = await requestJson<unknown>(baseUrls, `/v1/workers/${encodeURIComponent(workerId)}/tokens`, {
        method: "POST",
        token,
        organizationId: orgId,
        body: {},
      });
      const tokens = getWorkerTokens(payload);
      if (!tokens) {
        throw new DenApiError(500, "invalid_worker_token_payload", "Worker token response was missing token values.");
      }
      return tokens;
    },

    async getCloudInstance(orgId: string): Promise<DenCloudInstance> {
      const payload = await requestJson<unknown>(baseUrls, "/v1/cloud/instance", {
        method: "GET",
        token,
        organizationId: orgId,
      });
      const instance = parseCloudInstance(payload);
      if (!instance) {
        throw new DenApiError(500, "invalid_cloud_instance_payload", "Cloud instance response was invalid.");
      }
      return instance;
    },

    async retryCloudInstance(orgId: string): Promise<DenCloudInstance> {

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Verify the workerId is still registered; re-provision the worker if not
2. Log the raw payload and compare with the expected DenWorkerTokens shape
3. Align server/client versions
4. Re-authenticate and retry once in case of transient server state

Example fix

// before
const tokens = await client.getWorkerTokens(workerId, orgId);
startWorker(tokens);
// after
try { startWorker(await client.getWorkerTokens(workerId, orgId)); }
catch (err) {
  if (err instanceof DenApiError && err.code === "invalid_worker_token_payload") await reprovisionWorker(workerId, orgId);
  else throw err;
}

if (!workerId) throw new Error("workerId is required");
if (!orgId) throw new Error("An organization id is required to fetch worker tokens");

const isDenWorkerTokens = (t: unknown): t is DenWorkerTokens =>
  typeof t === "object" && t !== null && "token" in t && typeof (t as { token: unknown }).token === "string";

try {
  tokens = await client.getWorkerTokens(workerId, orgId);
} catch (err) {
  if (err instanceof DenApiError && err.code === "invalid_worker_token_payload") {
    await reprovisionWorker(workerId, orgId);
    tokens = await client.getWorkerTokens(workerId, orgId);
  } else throw err;
}

When it happens

Trigger: The worker token endpoint returns 2xx but the body omits token fields — unknown/expired workerId accepted oddly, server schema drift, or a non-Den server on the configured baseUrl.

Common situations: Worker was deregistered server-side while the client still holds its id, self-hosted Den running an older API shape, or proxy interference.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• invalid_session_payload
• invalid_app_version_payload
• invalid_resource_snapshot_payload
• invalid_mcp_token_payload
• request_failed

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/cf0e53a19fc7d898. Report an issue: GitHub.