paperclipai/paperclip · warning · Error

Add #token=YOUR_TOKEN to this URL

Error message

Add #token=YOUR_TOKEN to this URL

What it means

This message originates in the client-side JavaScript embedded in the HTML returned by the kv-demo render module. In refresh(), when TOKEN_REQUIRED is true and the page was loaded without a #token= fragment, the function throws before issuing the fetch. The status element then displays 'Refresh failed: Add #token=YOUR_TOKEN to this URL'.

Source

Thrown at packages/kv-demo-mcp-server/src/render.ts:99

      document.getElementById("count").textContent = state.count;
      document.getElementById("revision").textContent = state.revision;
      const rows = document.getElementById("rows");
      if (!state.entries.length) {
        rows.innerHTML = '<tr class="empty"><td colspan="3">No values yet — call the <code>kv_set</code> tool to add one.</td></tr>';
        return;
      }
      rows.innerHTML = state.entries.map((entry) =>
        '<tr><td class="key">' + escapeHtml(entry.key) +
        '</td><td class="value">' + escapeHtml(entry.value) +
        '</td><td class="updated">' + escapeHtml(entry.updatedAt) + '</td></tr>'
      ).join("");
    }
    async function refresh() {
      const status = document.getElementById("status");
      try {
        const headers = { accept: "application/json" };
        if (token) headers.authorization = "Bearer " + token;
        if (TOKEN_REQUIRED && !token) throw new Error("Add #token=YOUR_TOKEN to this URL");
        const res = await fetch("/api/state", { headers });
        if (!res.ok) throw new Error("HTTP " + res.status);
        render(await res.json());
        status.textContent = "Auto-refreshing every 2s.";
      } catch (err) {
        status.textContent = "Refresh failed: " + err.message;
      }
    }
    setInterval(refresh, 2000);
  </script>
</body>
</html>`;
}

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Append #token=YOUR_TOKEN to the dashboard URL in the browser address bar and reload.
2. If token auth is not required, restart the server without the token / with TOKEN_REQUIRED=false.
3. Distribute the full URL including the #token= fragment to users.

Example fix

// before
https://host:8848/
// after
https://host:8848/#token=correct-token-here

// client-side, in the dashboard boot script
if (TOKEN_REQUIRED && !new URL(location.href).hash.match(/^#token=.+/)) {
  prompt('Token required: append #token=YOUR_TOKEN to the URL');
}

When it happens

Trigger: The operator started the kv-demo server with token auth enabled (TOKEN_REQUIRED) but the user opened the dashboard URL without appending #token=<the configured token> to the URL hash.

Common situations: Sharing the dashboard URL without the token fragment; token rotated server-side but the bookmark still has the old/empty hash; user clears the URL hash.

Related errors

• HTTP ${status}
• Request failed: ${response.status}
• CLI auth challenge was cancelled.
• CLI auth challenge expired before approval.
• Environment variable ${envName} is empty or not set.

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/27e7a382763062fe. Report an issue: GitHub.