eyaltoledano/claude-task-master · error · AuthenticationError

CODE_AUTH_FAILED

CODE_AUTH_FAILED

Error message

`Token authentication failed: ${(error as Error).message}`

What it means

AuthenticationError with code CODE_AUTH_FAILED thrown by authenticateWithCode's catch block for any exception that is not already an AuthenticationError. It wraps unexpected failures during one-time-token authentication (network errors, Supabase client exceptions, context store errors) with the original message interpolated.

Source

Thrown at packages/tm-core/src/modules/auth/services/session-manager.ts:293

				token: session.access_token,
				refreshToken: session.refresh_token,
				userId: user.id,
				email: user.email,
				expiresAt: session.expires_at
					? new Date(session.expires_at * 1000).toISOString()
					: undefined,
				tokenType: 'standard',
				savedAt: new Date().toISOString(),
				selectedContext: context || undefined
			};

			this.logger.info('Successfully authenticated with token');
			return credentials;
		} catch (error) {
			if (error instanceof AuthenticationError) {
				throw error;
			}
			throw new AuthenticationError(
				`Token authentication failed: ${(error as Error).message}`,
				'CODE_AUTH_FAILED'
			);
		}
	}

	/**
	 * Verify MFA code and complete authentication
	 * Call this after authenticateWithCode() throws MFA_REQUIRED error
	 */
	async verifyMFA(factorId: string, code: string): Promise<AuthCredentials> {
		await this.waitForInitialization();
		try {
			this.logger.info('Verifying MFA code...');

			// Verify MFA code and get upgraded session
			const session = await this.supabaseClient.verifyMFA(factorId, code);

View on GitHub (pinned to c0c98d367c)

Solutions

1. Read the interpolated underlying message to find the real failure point
2. Verify network reachability and Supabase client configuration (URL/keys)
3. Clear/corruption-check local auth context storage, then retry
4. Retry with a freshly generated one-time token after fixing the environment issue

Example fix

// before
await sessionManager.authenticateWithCode(token);
// after: surface the underlying cause and retry once
try {
  await sessionManager.authenticateWithCode(token);
} catch (e) {
  console.error('Code auth failed:', (e as Error).message);
  await sessionManager.authenticateWithCode(await getFreshToken());
}

if (!process.env.SUPABASE_URL) throw new Error('SUPABASE_URL not configured');
const token = rawToken?.trim();
if (!token) throw new Error('One-time token required');

function isCodeAuthFailed(e: unknown): e is AuthenticationError {
  return e instanceof AuthenticationError && e.code === 'CODE_AUTH_FAILED';
}

try {
  await sessionManager.authenticateWithCode(token);
} catch (e) {
  if (isCodeAuthFailed(e)) {
    logger.error('Token auth failed:', e.message); // includes root cause
    await retryWithFreshToken();
  } else throw e;
}

When it happens

Trigger: Calling authenticateWithCode(token) when any internal step throws outside the guarded AuthenticationError paths: fetch rejection to Supabase, malformed client initialization, exceptions in checkMFARequired() or contextStore.saveContext(), or a TypeError in the credentials-building code.

Common situations: Offline or proxied environments; misconfigured Supabase URL causing client-side errors; corrupted local auth/context storage causing saveContext to throw; a token containing characters that break the request unexpectedly.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• START_FLOW_FAILED
• NO_TOKEN
• PKCE_FAILED
• REFRESH_FAILED
• CODE_AUTH_FAILED

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/9fe016f2701cdcfb. Report an issue: GitHub.