different-ai/openwork · error

SSO domain verification token was missing from the response.

Error message

SSO domain verification token was missing from the response.

What it means

handleRequestDomainToken requests an SSO domain-verification token from the Den API and expects the payload to contain a non-empty string at domainVerificationToken. If the token is absent, wrong-typed, or an empty string, it throws 'SSO domain verification token was missing from the response.' This blocks the DNS-verification flow from showing an invalid TXT record.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_components/sso-screen.tsx:262

      setError("Only workspace owners and super-admins can request SSO domain verification tokens.");
      return;
    }
    if (!orgId || !connection) return;
    setError(null);
    try {
      await runReauthableAction("request-sso-domain-token", async () => {
        setRequestingDomainToken(true);
        try {
          const { response, payload } = await requestJson("/v1/sso/request-domain-verification", { method: "POST", headers: getOrgScopedHeaders(), body: JSON.stringify({}) }, 12000);
          if (!response.ok) {
            throw getRequestError(payload, response, `Failed to request domain verification (${response.status}).`);
          }

          const token = typeof (payload as { domainVerificationToken?: unknown } | null)?.domainVerificationToken === "string"
            ? (payload as { domainVerificationToken: string }).domainVerificationToken
            : "";
          if (!token) {
            throw new Error("SSO domain verification token was missing from the response.");
          }
          setDomainVerificationToken(token);
        } finally {
          setRequestingDomainToken(false);
        }
      });
    } catch (nextError) {
      setError(nextError instanceof Error ? nextError.message : "Failed to request domain verification.");
    }
  }

  async function handleVerifyDomain() {
    if (!access.canManageSso) {
      setError("Only workspace owners and super-admins can verify SSO domains.");
      return;
    }
    if (!orgId || !connection) return;
    setError(null);

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Log/inspect the raw payload to confirm domainVerificationToken is absent vs empty vs differently named.
2. Verify the domain is registered for the org and the requesting admin has SSO admin permissions, then retry the request.
3. Check server version exposes domainVerificationToken; upgrade/redeploy the Den API if the field is missing.
4. Ensure the client reads the correct response field if the API renamed it (update the payload typing).

Example fix

// before
const token = typeof payload?.domainVerificationToken === "string" ? payload.domainVerificationToken : "";
if (!token) throw new Error("SSO domain verification token was missing from the response.");
// after
const token = typeof payload?.domainVerificationToken === "string" ? payload.domainVerificationToken
  : typeof payload?.data?.domainVerificationToken === "string" ? payload.data.domainVerificationToken : "";
if (!token) throw new Error(`SSO domain verification token missing. Payload keys: ${payload ? Object.keys(payload).join(",") : "null"}`);

function hasDomainVerificationToken(v: unknown): v is { domainVerificationToken: string } {
  return isRecord(v) && typeof v.domainVerificationToken === "string" && v.domainVerificationToken.length > 0;
}

function isTokenPayload(v: unknown): v is { domainVerificationToken: string } {
  return isRecord(v) && typeof v.domainVerificationToken === "string" && v.domainVerificationToken !== "";
}

try {
  await handleRequestDomainToken(domain);
} catch (e) {
  if (e instanceof Error && e.message.includes("verification token was missing")) {
    // surface: check domain registration / admin permission, then retry
  } else throw e;
}

When it happens

Trigger: POST/GET of the domain-verification token returns ok but payload.domainVerificationToken is undefined, not a string, or "" — e.g. domain not registered for the org, feature flag off, or server-side token generation failed silently.

Common situations: Org has no SSO domain configured yet so the API omits the token; admin lacks permission and API returns 200 with an empty payload; server version predates the domainVerificationToken field; a captive proxy returns an unexpected JSON body.

Related errors

• request_failed
• invalid_session_payload
• invalid_app_version_payload
• invalid_resource_snapshot_payload
• invalid_mcp_token_payload

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/270756d14145bf24. Report an issue: GitHub.