hcengineering/platform · error

Missing workspace in token

Error message

Missing workspace in token

What it means

The create-subscription route requires the token's workspace claim. If req.token.workspace is undefined after the account check passes, the request is rejected with 401 'Missing workspace in token', since subscriptions are created per workspace.

Source

Thrown at services/payment/pod-payment/src/server.ts:217

        return
      }

      void handleRequest(
        ctx,
        'create-subscription',
        async (ctx) => {
          const workspaceUuid = req.token?.workspace
          const accountUuid = req.token?.account
          const request = req.body as SubscribeRequest
          const loginInfo = req.loginInfo as WorkspaceLoginInfo

          if (accountUuid === undefined) {
            res.status(401).json({ error: 'Missing account in token' })
            return
          }

          if (workspaceUuid === undefined) {
            res.status(401).json({ error: 'Missing workspace in token' })
            return
          }

          if (loginInfo?.workspaceUrl === undefined) {
            res.status(401).json({ error: 'Missing workspace url in login info' })
            return
          }

          if (request.type === undefined || request.plan === undefined) {
            res.status(400).json({ error: 'Missing required fields: type, plan' })
            return
          }

          let createSubResponse: CheckoutResponse

          try {
            createSubResponse = await provider.createSubscription(
              ctx,

View on GitHub (pinned to 63e28dc964)

Solutions

1. Obtain a token scoped to a workspace (complete workspace selection/login flow) and retry
2. Ensure the auth service includes workspace in the token payload
3. Verify middleware maps the correct claim into req.token.workspace
4. Check client state sends the workspace-scoped token, not the account-only one

Example fix

// before
const token = await auth.login(email) // no workspace scope
// after
const token = await auth.loginToWorkspace(workspaceId, email)

const payload = decodeJwt(token)
if (payload.workspace === undefined) {
  throw new Error('Token is missing the workspace claim; log in to a workspace first')
}

function tokenHasWorkspace(token: { workspace?: string } | undefined): token is { workspace: string } {
  return typeof token?.workspace === 'string' && token.workspace.length > 0
}

When it happens

Trigger: Token issued without a workspace claim; user token from an auth flow that doesn't scope to a workspace; request hitting the subscription endpoint before workspace selection in the client; claim name mismatch between issuer and middleware.

Common situations: Client calling subscription APIs on a bare account token; multi-tenant apps where the login flow skips workspace context; older tokens minted before workspace claims existed.

Related errors

• Missing account in token
• platform.status.Unauthorized
• Unauthorized
• Couldn't find workspace with the provided token
• Unauthorized

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/f89ea4829af0266c. Report an issue: GitHub.