elsa-workflows/elsa-core · error · CryptographicException

Token payload is not a valid non-expiring token.

Error message

Token payload is not a valid non-expiring token.

What it means

DataProtectorTokenService.Unprotect decrypts a SAS token and, for non-expiring tokens, expects the plaintext payload to be valid JSON. If JsonDocument.Parse throws JsonException, the service wraps it in a CryptographicException with this message, signaling that decryption succeeded but the payload is not a token this service produced.

Solutions

1. Regenerate the token with the same DataProtectorTokenService (and matching Data Protection key ring) that will consume it.
2. Verify you are not passing a raw secret or a different token type to Unprotect.
3. Check the token was not truncated/whitespace-mangled in transport (query strings, config files, logs).
4. If tokens must survive across environments, ensure ASP.NET Core Data Protection keys are shared/persisted; note the payload was decryptable here, so focus on token format/version.

Example fix

// before
var json = tokenService.Unprotect(rawConnectionString);
// after
var sasToken = await tokenService.CreateTokenAsync(resource, expiresAt: null);
var json = tokenService.Unprotect(sasToken);

try
{
    var json = tokenService.Unprotect(token);
}
catch (System.Security.Cryptography.CryptographicException ex)
{
    logger.LogWarning(ex, "Token rejected: not a valid non-expiring token payload.");
    // treat as unauthenticated / re-issue token
}

When it happens

Trigger: Calling Unprotect on a token whose decrypted content is not JSON — tokens minted by a different service/format, manually crafted or corrupted strings, truncated tokens, or binary payloads passed as tokens.

Common situations: Passing a plain connection string or API key where an Elsa SAS token is expected; tokens generated by an older Elsa version with a different payload format; copy/paste truncation or encoding corruption of the token value.

Related errors

• Cannot convert to bool
• Cannot convert to bool?
• Cannot deserialize to .
• Cannot determine the element type of array
• Expected a metadata property name.

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/877765c4d763630b. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.SasTokens/Contracts/DataProtectorTokenService.cs:98

        try
        {
            return _timeLimitedDataProtector.Unprotect(token);
        }
        catch (CryptographicException)
        {
            var json = _dataProtector.Unprotect(token);

            // Expired time-limited tokens can be decrypted by the base protector,
            // but the result includes the expiration header.
            // Only accept fallback payloads that are standalone JSON produced by CreateToken(payload).
            try
            {
                using var _ = JsonDocument.Parse(json);
                return json;
            }
            catch (JsonException e)
            {
                throw new CryptographicException("Token payload is not a valid non-expiring token.", e);
            }
        }
    }
}

View on GitHub (pinned to fe9217bdfa)