paperclipai/paperclip · error · SetupTokenSessionError

Setup-token login session not found.

Error message

Setup-token login session not found.

What it means

SetupTokenSessionService.resolveOwned found no stored session whose id matches AND whose scope (company, owner, adapter) equals the caller scope. Missing and cross-scope sessions intentionally raise the same not-found error so callers cannot probe other scopes.

Source

Thrown at server/src/services/setup-token-session.ts:1059

        // The writer transitions the durable row to `stored` and writes the
        // secret in one transaction. A zero-row transition or a storage failure
        // rejects and rolls back both.
        await this.completeCredential({ scope: session.scope, sessionId: session.id, token });
      } catch {
        await this.terminateLocked(session, "failed");
        throw new SetupTokenSessionError(500, SETUP_TOKEN_STORAGE_FAILED);
      }
      // The transaction committed while the service held the lock, so a cancel or
      // an expiry could not interleave. Record the non-secret marker. The durable
      // row is already `stored` from the committed transition.
      session.secretStored = true;
    });
  }

  /**
   * Resolves a session for an operation. It returns the session only when the
   * id exists and the stored scope equals the caller scope in all three identity
   * fields: the company, the owner, and the adapter. A missing session and a
   * cross-scope session both throw the same not-found error, so a caller cannot
   * tell them apart. The scope match makes a cross-company, a cross-owner, and a
   * cross-adapter session return the same not-found error as a missing session.
   */
  private resolveOwned(sessionId: string, scope: SetupTokenSessionScope): StoredSession {
    const session = this.sessions.get(sessionId);
    if (
      !session ||
      session.scope.companyId !== scope.companyId ||
      session.scope.ownerUserId !== scope.ownerUserId ||
      session.scope.adapterType !== scope.adapterType
    ) {
      throw new SetupTokenSessionError(404, SETUP_TOKEN_SESSION_NOT_FOUND);
    }
    return session;
  }

  /**

View on GitHub (pinned to 01ad858492)

Solutions

1. Restart the setup-token login flow to create a fresh session
2. Verify the session id was copied complete and unmodified
3. Confirm the session belongs to the same company, owner user, and adapter as the caller
4. Check the session was not expired/evicted by retention cleanup

When it happens

Trigger: Thrown at server/src/services/setup-token-session.ts:1022 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-21). Data as JSON: /api/errors/5ea2c480c01cb3be. Report an issue: GitHub.