What causes "Sign in to your Den portal to install OpenWork." in different-ai/openwork?

Sign in to the Den portal, then reopen the install screen so the request carries the session.

Sign in to your Den portal to install OpenWork.

Error message

Sign in to your Den portal to install OpenWork.

What it means

fetchInstallConfig in the Den install screen fetches /v1/install-config with an optional install token. If the response is 401 and no token was supplied, it throws "Sign in to your Den portal to install OpenWork." — the server requires an authenticated Den session (or a valid install token) to hand out installer configuration.

Source

Thrown at ee/apps/den-web/app/(den)/_components/install-screen.tsx:165

    apiUrl,
    requireSignin,
    logoUrl,
    iconUrl,
    desktopVersion,
    distribution,
  };
}

async function fetchInstallConfig(token: string | null) {
  const path = token ? `/v1/install-config?token=${encodeURIComponent(token)}` : "/v1/me/install-config";
  const { response, payload } = await requestJson(
    path,
    { method: "GET" },
    12000,
  );
  if (!response.ok) {
    if (!token && response.status === 401) {
      throw new Error("Sign in to your Den portal to install OpenWork.");
    }
    throw new Error(getInstallConfigErrorMessage(payload, response.status));
  }
  const parsed = parseInstallConfig(payload);
  if (!parsed) {
    throw new Error("This install link returned incomplete setup details.");
  }
  return parsed;
}

function installHref(config: InstallConfig, platform: InstallPlatform, token: string | null) {
  return token
    ? buildInstallDownloadHref(config.apiUrl, platform, token)
    : buildAuthenticatedInstallDownloadHref(config.apiUrl, platform);
}

type StepState = "complete" | "active" | "pending";

View on GitHub (pinned to 2b7df46e8a)

Solutions

Sign in to the Den portal, then reopen the install screen so the request carries the session.
Ask the workspace admin for a fresh install link that includes the token and open it as-is (don't trim the query string).
If the link exists, ensure installTokenFromPageUrl is extracting the token correctly before fetchInstallConfig runs.

Example fix

// before
await fetchInstallConfig(null)  // 401, no token
// after
const token = installTokenFromPageUrl(installPageUrl);
await fetchInstallConfig(token)

Defensive patterns

Strategy: type-guard

Validate before calling

const token = installTokenFromPageUrl(window.location.href);
if (!token) {
  // route the user to Den sign-in instead of calling the API
  redirectToSignIn();
}

Type guard

function hasInstallToken(t) {
  return typeof t === "string" && t.trim().length > 0;
}

Try / catch

try {
  await fetchInstallConfig(token);
} catch (err) {
  if (err.message === "Sign in to your Den portal to install OpenWork.") {
    showSignInPrompt();
  } else throw err;
}

Prevention

Check for the token query param on the install page before fetching config.
Never share install links through sanitizers that strip query strings.
Generate links via the admin Members page so they include a valid token.

When it happens

Trigger: Opening the install page with an install link whose token is absent/missing from the URL, causing an unauthenticated GET to /v1/install-config that returns 401.

Common situations: User copied the install page URL without the token query parameter; token was stripped by a link sanitizer/chat client; user hit the install screen directly instead of via an admin-generated install link.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/72caf7b81a47950a. Report an issue: GitHub.