eyaltoledano/claude-task-master · error · AuthenticationError

NO_TOKEN

NO_TOKEN

Error message

'Failed to obtain access token from token'

What it means

AuthenticationError with code NO_TOKEN thrown by SessionManager.authenticateWithCode when verifyOneTimeCode(token) returns null or a session without an access_token. It means Supabase did not accept the one-time token, so no usable session could be established from it.

Source

Thrown at packages/tm-core/src/modules/auth/services/session-manager.ts:234

	}

	// ========== Authentication ==========

	/**
	 * Authenticate using a one-time token
	 * This is useful for CLI authentication in SSH/remote environments
	 * where browser-based auth is not practical
	 */
	async authenticateWithCode(token: string): Promise<AuthCredentials> {
		await this.waitForInitialization();
		try {
			this.logger.info('Authenticating with one-time token...');

			// Verify the token and get session from Supabase
			const session = await this.supabaseClient.verifyOneTimeCode(token);

			if (!session || !session.access_token) {
				throw new AuthenticationError(
					'Failed to obtain access token from token',
					'NO_TOKEN'
				);
			}

			// Get user information
			const user = await this.supabaseClient.getUser();

			if (!user) {
				throw new AuthenticationError(
					'Failed to get user information',
					'INVALID_RESPONSE'
				);
			}

			// Check if MFA is required for this user
			const mfaCheck = await this.supabaseClient.checkMFARequired();

View on GitHub (pinned to c0c98d367c)

Solutions

1. Generate a fresh one-time token and use it immediately before it expires
2. Verify the token is copied completely and without whitespace (trim before passing)
3. Confirm the Supabase client config points at the same project that issued the token
4. If the flow keeps failing, use the standard browser-based login instead

Example fix

// before: reusing an old token
await sessionManager.authenticateWithCode(storedToken);
// after: obtain and validate a fresh token
const token = await getFreshOneTimeToken();
if (!token || token.trim().length < 10) {
  throw new Error('No valid one-time token available');
}
await sessionManager.authenticateWithCode(token.trim());

// validate the one-time token before submitting it
const token = rawToken?.trim();
if (!token || token.length < 8) {
  throw new Error('Provide a fresh one-time token from the login URL');
}

function isNoTokenError(e: unknown): e is AuthenticationError {
  return e instanceof AuthenticationError && e.code === 'NO_TOKEN';
}

try {
  await sessionManager.authenticateWithCode(token);
} catch (e) {
  if (isNoTokenError(e)) {
    const fresh = await requestNewOneTimeToken(); // re-run browser flow
    await sessionManager.authenticateWithCode(fresh.trim());
  } else throw e;
}

When it happens

Trigger: Calling authenticateWithCode(token) with an expired one-time token, an already-consumed token, a mistyped/truncated token copied from the browser flow, or a token issued by a different Supabase project.

Common situations: SSH/remote-headless auth where the one-time token sits in the terminal past its expiry window; pasting the token with trailing whitespace or missing characters; generating a new token but submitting the old one; environment pointing at a different Supabase project than the one that issued the token.

Related errors

• REFRESH_FAILED
• INVALID_RESPONSE
• MFA_REQUIRED
• CODE_AUTH_FAILED
• CONFIG_MISSING

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/d8267729cb6491ae. Report an issue: GitHub.