multica-ai/multica · error · ErrStateExpired

composio: state expired

Error message

composio: state expired

What it means

Error "composio: state expired" thrown in multica-ai/multica.

Source

Thrown at server/internal/integrations/composio/state.go:24

	"encoding/base64"
	"encoding/json"
	"errors"
	"strings"
	"time"
)

// Signed-state errors. The handler maps all of them to a generic
// "connect failed" redirect so a tampered/expired state never leaks which
// check failed.
var (
	// ErrStateMalformed is returned when the state token is not the expected
	// "<payload>.<sig>" base64url shape.
	ErrStateMalformed = errors.New("composio: state malformed")
	// ErrStateSignature is returned when the HMAC signature does not match —
	// the state was tampered with or signed by a different secret.
	ErrStateSignature = errors.New("composio: state signature mismatch")
	// ErrStateExpired is returned when the state's exp claim is in the past.
	ErrStateExpired = errors.New("composio: state expired")
)

// stateClaims is the payload embedded in the signed connect-state. It carries
// exactly what CompleteCallback needs to attribute the callback to a user and
// toolkit without a server-side session table — the signature is what makes it
// trustworthy, the short exp is what bounds replay.
//
// Field names are single letters to keep the encoded token compact; they are
// an internal wire format, never exposed to clients.
type stateClaims struct {
	UserID      string `json:"u"`
	ToolkitSlug string `json:"t"`
	// AuthConfigID is the exact Composio auth_config_id resolved at BeginConnect
	// and used to create the connect link. Signing it into the state lets
	// CompleteCallback verify the returned account was created under THIS
	// toolkit's auth config without re-resolving (which could fail-open). It is
	// an opaque config handle (ac_…), not a credential.
	AuthConfigID string `json:"a"`

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Restart the OAuth flow; the state token has expired.

When it happens

Trigger: Thrown at server/internal/integrations/composio/state.go:24 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/753e0f7b3c3b1761. Report an issue: GitHub.