mastra-ai/mastra · error

Failed to create access token (${res.status})

Error message

Failed to create access token (${res.status})

What it means

After the observability project exists, the CLI mints an organization access token via POST /v1/auth/tokens and reads the secret from the response. This error is thrown when the request returns a non-2xx status.

Source

Thrown at packages/cli/src/commands/init/observability-provision.ts:216

  return body.project;
}

async function mintOrgToken({
  token,
  orgId,
  keyName,
}: {
  token: string;
  orgId: string;
  keyName: string;
}): Promise<string> {
  const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/auth/tokens`, {
    method: 'POST',
    headers: { ...authHeaders(token, orgId), 'Content-Type': 'application/json' },
    body: JSON.stringify({ name: keyName }),
  });
  if (!res.ok) {
    throw new Error(`Failed to create access token (${res.status})`);
  }
  const body = (await res.json()) as CreateTokenResponse;
  return body.secret;
}

/**
 * Derive a per-project spans endpoint matching the mobs-collector route
 * `POST /projects/:projectId/ai/spans/publish`. Only used when a non-default
 * platform URL is in play; production usage relies on the
 * MastraPlatformExporter's own default base.
 */
function deriveTracesEndpoint(platformUrl: string, projectId: string): string {
  // Strip a trailing /v1 (or any other path) — we want the host root.
  const url = new URL(platformUrl);
  return `${url.origin}/projects/${projectId}/ai/spans/publish`;
}

View on GitHub (pinned to 75dd419e61)

Solutions

1. On 401/403, re-authenticate (`mastra login`) and ensure your role allows creating organization tokens.
2. Check org settings/policies that may restrict token creation.
3. Retry on 429/5xx after a delay.
4. Verify network connectivity to the Mastra platform API.

const token = await getValidPlatformToken(); // must be an org token with token-creation scope
if (!token) throw new Error('Re-authenticate before minting org tokens');

try {
  await provisionObservabilityProject(...);
} catch (err) {
  if (err.message.startsWith('Failed to create access token')) {
    const status = err.message.match(/\((\d+)\)/)?.[1];
    if (status === '401' || status === '403') {
      // check org role/permissions, then re-auth
    } else if (status === '429' || status?.startsWith('5')) {
      await retryWithBackoff();
    }
  }
}

When it happens

Trigger: provisionObservabilityProject calls mintOrgToken and the platform rejects the token-creation request: 401/403 (insufficient permissions to create org tokens), 429 (rate limit), or 5xx.

Common situations: Authenticated user lacking org admin/token-creation rights, expired session token, org-level policy forbidding API tokens, or transient platform failures.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• Failed to list projects (${res.status})
• Perplexity Search request failed with status ${response.stat
• Failed to fetch Copilot models: ${response.status} ${respons
• AuthFailureError(authFailureStatus, error)
• Failed to create project (${res.status})

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/9c1b667ada150181. Report an issue: GitHub.