mastra-ai/mastra · critical

No token verification method configured

Error message

No token verification method configured

What it means

The core auth middleware verifies the request's bearer token via authConfig.authenticateToken. If no `authenticateToken` function is configured on the auth config, there is no way to verify tokens, so middleware throws this error (resulting in an auth failure response).

Source

Thrown at packages/server/src/server/auth/helpers.ts:392

  // When a route explicitly requires auth (requiresAuth: true), skip the
  // public-path bypass so the user is still authenticated and permissions
  // are injected into the request context.
  if (!requiresAuth && canAccessPublicly(path, method, authConfig)) {
    return pass;
  }

  // ── Authentication ──

  let user: unknown;
  let refreshHeaders: Record<string, string> | undefined;
  const authRequest = adaptToMastraAuthRequest(rawRequest);

  try {
    if (typeof authConfig.authenticateToken === 'function') {
      user = await authConfig.authenticateToken(token ?? '', authRequest);
    } else {
      throw new Error('No token verification method configured');
    }

    // If authentication failed, attempt transparent session refresh before returning 401.
    // This handles expired access tokens without requiring client-side refresh logic.
    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {
      try {
        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);
        if (sessionId) {
          const newSession = await authConfig.refreshSession(sessionId);
          if (newSession) {
            // Refresh succeeded — build updated session headers and re-authenticate.
            // We create a synthetic request with the new session cookie so
            // authenticateToken (which reads cookies from the request) picks up
            // the refreshed session instead of the expired one.
            refreshHeaders = authConfig.getSessionHeaders(newSession);
            const refreshedCookie = Object.entries(refreshHeaders)
              .filter(([k]) => k.toLowerCase() === 'set-cookie')
              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes

View on GitHub (pinned to 75dd419e61)

Solutions

1. Provide `authenticateToken: async (token, request) => { ...verify and return user... }` in your auth config
2. If using sessions/JWT from a provider, use the built-in auth config helper that wires authenticateToken for you
3. Log/inspect the resolved authConfig at startup to confirm authenticateToken is a function
4. Check version migration notes — older `verifyToken` style options must be migrated to authenticateToken

Example fix

// before
export const authConfig = { authorizeUser: async u => u }
// after
export const authConfig = {
  authenticateToken: async (token, req) => verifyJwt(token),
  authorizeUser: async u => u,
}

function assertAuthConfig(cfg: unknown): asserts cfg is { authenticateToken: Function } {
  const c = cfg as Record<string, unknown>;
  if (typeof c?.authenticateToken !== 'function') {
    throw new Error('authConfig.authenticateToken must be a function');
  }
}
// call at server startup: assertAuthConfig(authConfig);

const hasTokenVerifier = (cfg: unknown): cfg is { authenticateToken: (t: string, r: Request) => Promise<unknown> } =>
  typeof (cfg as { authenticateToken?: unknown })?.authenticateToken === 'function';

try {
  await authorizeRequest(req);
} catch (err) {
  if (err instanceof Error && err.message === 'No token verification method configured') {
    logger.error('Server auth misconfigured: authenticateToken missing');
    return new Response('Auth misconfigured', { status: 500 });
  }
  return new Response('Unauthorized', { status: 401 });
}

When it happens

Trigger: A request hits an authenticated route while the server's auth configuration object lacks a `authenticateToken` function — e.g. passing only `authorizeUser`/session options, or passing an auth config of the wrong shape.

Common situations: Upgrading @mastra/core/server where auth config shape changed, copying an auth config snippet that only includes authorization rules, forgetting to wire the token verifier in a custom JWT/OAuth setup, or exporting the wrong object from the auth config module.

Related errors

• Clerk JWKS URI, secret key and publishable key are required,
• Cookie password must be at least 32 characters for SSO. Set
• Redirect URI is required for SSO login
• Google service account private key signing failed (${(err as
• Neon Auth base URL is required, please provide it in the opt

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/6aa8643259874ba5. Report an issue: GitHub.