hcengineering/platform · error

Missing account in token

Error message

Missing account in token

What it means

The create-subscription route requires the authenticated token to carry an account UUID. If req.token.account is undefined the request is rejected with 401 'Missing account in token' because subscriptions must be attributed to an account.

Source

Thrown at services/payment/pod-payment/src/server.ts:212

    withLoginInfo,
    withOwner,
    (req: RequestWithAuth, res: Response) => {
      if (provider === undefined || serviceToken === undefined) {
        res.status(503).json({ error: 'Payment provider is not configured' })
        return
      }

      void handleRequest(
        ctx,
        'create-subscription',
        async (ctx) => {
          const workspaceUuid = req.token?.workspace
          const accountUuid = req.token?.account
          const request = req.body as SubscribeRequest
          const loginInfo = req.loginInfo as WorkspaceLoginInfo

          if (accountUuid === undefined) {
            res.status(401).json({ error: 'Missing account in token' })
            return
          }

          if (workspaceUuid === undefined) {
            res.status(401).json({ error: 'Missing workspace in token' })
            return
          }

          if (loginInfo?.workspaceUrl === undefined) {
            res.status(401).json({ error: 'Missing workspace url in login info' })
            return
          }

          if (request.type === undefined || request.plan === undefined) {
            res.status(400).json({ error: 'Missing required fields: type, plan' })
            return
          }

View on GitHub (pinned to 63e28dc964)

Solutions

1. Re-authenticate to obtain a fresh token containing the account claim
2. Fix token issuance in the auth service to always include account in the payload
3. Verify the auth middleware populates req.token.account from the correct claim name
4. Check the client isn't sending a service-only token for user-scoped operations

Example fix

// before (token payload)
{ "workspace": "ws_1" }
// after
{ "workspace": "ws_1", "account": "acc_42" }

const payload = decodeJwt(token)
if (payload.account === undefined) {
  throw new Error('Token is missing the account claim; re-authenticate')
}

function tokenHasAccount(token: { account?: string } | undefined): token is { account: string } {
  return typeof token?.account === 'string' && token.account.length > 0
}

When it happens

Trigger: Auth token (JWT/session token) issued without an account claim; using a service/automation token that lacks account context; auth middleware decoded a token whose payload predates the account claim schema; corrupted or handcrafted token.

Common situations: Client using an old cached token minted before account claims were added; internal service-to-service calls using machine tokens; auth provider misconfiguration omitting the account claim.

Related errors

• Missing workspace in token
• platform.status.Unauthorized
• Unauthorized
• Couldn't find workspace with the provided token
• Unauthorized

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/c9d0cb8a5d3f3101. Report an issue: GitHub.