multica-ai/multica · error · ErrBindingTokenInvalid

dingtalk: binding token invalid or expired

Error message

dingtalk: binding token invalid or expired

What it means

Error "dingtalk: binding token invalid or expired" thrown in multica-ai/multica.

Source

Thrown at server/internal/integrations/dingtalk/binding.go:34

	"github.com/multica-ai/multica/server/internal/integrations/channel/engine"
	db "github.com/multica-ai/multica/server/pkg/db/generated"
)

// This file is the DingTalk user-binding token flow: an unbound DingTalk user
// who messages the bot gets a "link your account" prompt (minted here, delivered
// by the OutboundReplier), clicks through to the in-product redeem page, and
// their DingTalk staff id is bound to their Multica account. It mirrors
// slack.BindingTokenService but runs on the generic channel_* queries with
// channel_type='dingtalk'.

// BindingTokenTTL bounds a token's life. The channel_binding_token CHECK
// enforces the same 15-minute cap so a misconfigured caller cannot mint longer.
const BindingTokenTTL = 15 * time.Minute

var (
	// ErrBindingTokenInvalid: token unknown / already consumed / expired. One
	// opaque error for all three avoids a replay timing oracle.
	ErrBindingTokenInvalid = errors.New("dingtalk: binding token invalid or expired")
	// ErrBindingAlreadyAssigned: this DingTalk user id is already bound to a
	// different Multica user (account transfer must go through explicit unbind).
	ErrBindingAlreadyAssigned = errors.New("dingtalk: user id is already bound to a different user")
	// ErrBindingNotWorkspaceMember: the redeemer is not a member of the token's
	// workspace. Translated to 403 at the HTTP boundary.
	ErrBindingNotWorkspaceMember = errors.New("dingtalk: redeemer is not a workspace member")
)

// BindingToken is a freshly minted token. The raw value is returned exactly
// once (embedded in the binding URL); only its hash is persisted.
type BindingToken struct {
	Raw       string
	ExpiresAt time.Time
}

// RedeemedBindingToken is returned after a successful redemption.
type RedeemedBindingToken struct {
	WorkspaceID    pgtype.UUID

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Request a new binding token and redeem it before it expires.

When it happens

Trigger: Thrown at server/internal/integrations/dingtalk/binding.go:34 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/099e0d69bf38924f. Report an issue: GitHub.