multica-ai/multica · error · ErrStateMalformed

composio: state malformed

Error message

composio: state malformed

What it means

Error "composio: state malformed" thrown in multica-ai/multica.

Source

Thrown at server/internal/integrations/composio/state.go:19

package composio

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"errors"
	"strings"
	"time"
)

// Signed-state errors. The handler maps all of them to a generic
// "connect failed" redirect so a tampered/expired state never leaks which
// check failed.
var (
	// ErrStateMalformed is returned when the state token is not the expected
	// "<payload>.<sig>" base64url shape.
	ErrStateMalformed = errors.New("composio: state malformed")
	// ErrStateSignature is returned when the HMAC signature does not match —
	// the state was tampered with or signed by a different secret.
	ErrStateSignature = errors.New("composio: state signature mismatch")
	// ErrStateExpired is returned when the state's exp claim is in the past.
	ErrStateExpired = errors.New("composio: state expired")
)

// stateClaims is the payload embedded in the signed connect-state. It carries
// exactly what CompleteCallback needs to attribute the callback to a user and
// toolkit without a server-side session table — the signature is what makes it
// trustworthy, the short exp is what bounds replay.
//
// Field names are single letters to keep the encoded token compact; they are
// an internal wire format, never exposed to clients.
type stateClaims struct {
	UserID      string `json:"u"`
	ToolkitSlug string `json:"t"`
	// AuthConfigID is the exact Composio auth_config_id resolved at BeginConnect

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Restart the OAuth flow; the state parameter could not be decoded.

When it happens

Trigger: Thrown at server/internal/integrations/composio/state.go:19 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/b35b69c946e5d06a. Report an issue: GitHub.