paperclipai/paperclip · error

Modal sandbox environments require both tokenId and tokenSec

Error message

Modal sandbox environments require both tokenId and tokenSecret to be configured.

What it means

Credential validation in resolveAuth for the Modal driver: one of tokenId/tokenSecret is missing from the environment config. Because the plugin worker child process does not inherit host env vars, MODAL_TOKEN_ID/MODAL_TOKEN_SECRET cannot be read there — both halves of the token pair must be stored in the environment config as company secrets.

Source

Thrown at packages/plugins/sandbox-providers/modal/src/plugin.ts:102

    cidrAllowlist: parseStringArray(raw.cidrAllowlist),
    reuseLease: raw.reuseLease === true,
  };
}

function isMultipleOf1000(value: number): boolean {
  return value > 0 && value % 1000 === 0;
}

function resolveAuth(config: ModalDriverConfig): { tokenId: string; tokenSecret: string } | null {
  // The plugin worker runs in a child process that does not inherit host env
  // vars (see PluginWorkerManager.spawnProcess), so MODAL_TOKEN_ID /
  // MODAL_TOKEN_SECRET cannot be read here. Credentials must come from the
  // environment config, which Paperclip stores as company secrets.
  const tokenId = config.tokenId ?? "";
  const tokenSecret = config.tokenSecret ?? "";
  if (!tokenId && !tokenSecret) return null;
  if (!tokenId || !tokenSecret) {
    throw new Error("Modal sandbox environments require both tokenId and tokenSecret to be configured.");
  }
  return { tokenId, tokenSecret };
}

function createModalClient(config: ModalDriverConfig): ModalClient {
  const auth = resolveAuth(config);
  const params: ConstructorParameters<typeof ModalClient>[0] = {};
  if (auth) {
    params.tokenId = auth.tokenId;
    params.tokenSecret = auth.tokenSecret;
  }
  if (config.environment) {
    params.environment = config.environment;
  }
  return new ModalClient(params);
}

async function resolveApp(client: ModalClient, config: ModalDriverConfig): Promise<App> {

View on GitHub (pinned to a7e689b3c3)

Solutions

1. Configure both tokenId and tokenSecret for Modal.

When it happens

Trigger: Thrown at packages/plugins/sandbox-providers/modal/src/plugin.ts:102 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/b4671fb6550dbb5e. Report an issue: GitHub.