eyaltoledano/claude-task-master · error · AuthenticationError

CODE_AUTH_FAILED

CODE_AUTH_FAILED

Error message

Token verification failed: ${(error as Error).message}

What it means

Catch-all wrapper in SupabaseClient.verifyOneTimeCode(): when verifyOtp throws an exception that is neither an AuthenticationError nor a Supabase auth error (which are converted with friendly messages or trigger the stale-session retry), it is wrapped as AuthenticationError with code CODE_AUTH_FAILED. It means the OTP verification flow crashed unexpectedly rather than returning a normal auth error.

Source

Thrown at packages/tm-core/src/modules/integration/clients/supabase-client.ts:453

			this.logger.info('Successfully verified authentication token');
			return data.session;
		} catch (error) {
			if (error instanceof AuthenticationError) {
				throw error;
			}

			// Handle raw Supabase auth errors that might be thrown
			if (isSupabaseAuthError(error)) {
				const retryResult = await this.handleRecoverableError(
					error,
					isRetry,
					retryFn
				);
				if (retryResult) return retryResult;
				throw toAuthenticationError(error, 'Token verification failed');
			}

			throw new AuthenticationError(
				`Token verification failed: ${(error as Error).message}`,
				'CODE_AUTH_FAILED'
			);
		}
	}

	/**
	 * Check if MFA is required for the current session
	 * @returns Object with required=true and factor details if MFA is required,
	 *          or required=false if session is already at AAL2 or no MFA is configured
	 */
	async checkMFARequired(): Promise<{
		required: boolean;
		factorId?: string;
		factorType?: string;
	}> {
		const client = this.getClient();

View on GitHub (pinned to c0c98d367c)

Solutions

1. Check network/DNS/proxy access to the Supabase project URL and retry the login.
2. Verify SUPABASE_URL and key configuration are correct and reachable (curl the health endpoint).
3. Clear the local session storage to rule out stale-state exceptions, then retry verification with a fresh token.
4. Read the wrapped message for the root exception; if it is a supabase-js bug, upgrade the dependency.

Example fix

// before
const session = await client.verifyOneTimeCode(token);
// after
try {
  const session = await client.verifyOneTimeCode(token);
} catch (e) {
  if (e instanceof AuthenticationError && e.code === 'CODE_AUTH_FAILED') {
    // prompt user to check connectivity and request a new token
  }
}

// guard before verifying
if (!navigator.onLine && typeof navigator !== 'undefined') throw new Error('Offline: cannot verify token');
if (!token) throw new Error('One-time token is required');

function isAuthenticationError(e: unknown): e is AuthenticationError {
  return e instanceof AuthenticationError;
}

const verifyWithRetry = async (token: string, attempts = 3) => {
  for (let i = 0; i < attempts; i++) {
    try { return await client.verifyOneTimeCode(token); }
    catch (e) {
      if (e instanceof AuthenticationError && e.code === 'CODE_AUTH_FAILED' && i < attempts - 1) {
        await new Promise(r => setTimeout(r, 2 ** i * 500)); // backoff for transient network issues
        continue;
      }
      throw e;
    }
  }
};

When it happens

Trigger: client.auth.verifyOtp() throwing: network/fetch failure, client not initialized, an unexpected exception inside supabase-js, or a non-AuthApiError being thrown by an interceptor or storage layer during the call.

Common situations: Offline machine or blocked Supabase domain during CLI login; invalid SUPABASE_URL causing fetch to throw; corrupted local session storage raising during the request; supabase-js version incompatibility throwing instead of returning errors.

Related errors

• PKCE_FAILED
• REFRESH_FAILED
• START_FLOW_FAILED
• REFRESH_FAILED
• NO_TOKEN

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/8ed0916e5cb077ac. Report an issue: GitHub.