payloadcms/payload · error · APIError

Missing required data.

Error message

Missing required data.

What it means

Thrown in `verifyEmailOperation` when `args` does not have its own `token` property (`!Object.prototype.hasOwnProperty.call(args, 'token')`). The verification token from the email link is mandatory. `APIError` with HTTP 400 (BAD_REQUEST).

Source

Thrown at packages/payload/src/auth/operations/verifyEmail.ts:25

import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'
import { commitTransaction } from '../../utilities/commitTransaction.js'
import { initTransaction } from '../../utilities/initTransaction.js'
import { killTransaction } from '../../utilities/killTransaction.js'

export type Args = {
  collection: Collection
  req: PayloadRequest
  token: string
}

export const verifyEmailOperation = async (args: Args): Promise<boolean> => {
  const { collection, req, token } = args

  if (collection.config.auth.disableLocalStrategy) {
    throw new Forbidden(req.t)
  }
  if (!Object.prototype.hasOwnProperty.call(args, 'token')) {
    throw new APIError('Missing required data.', httpStatus.BAD_REQUEST)
  }

  try {
    const shouldCommit = await initTransaction(req)

    const where = appendNonTrashedFilter({
      enableTrash: Boolean(collection.config.trash),
      trash: false,
      where: {
        _verificationToken: { equals: token },
      },
    })

    const user = await req.payload.db.findOne<any>({
      collection: collection.config.slug,
      req,
      where,
    })

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Pass the token from the email link as the `token` arg: `payload.verifyEmail({ collection, token, req })`.
2. Ensure the REST route includes the token segment and the handler binds it to `args.token`.
3. Validate presence before calling.

Example fix

// before
await payload.verifyEmail({ collection, req })
// after
await payload.verifyEmail({ collection, token, req })

// Ensure the token is present before verifying
if (!token) {
  throw new Error('Verification token is required')
}
await payload.verifyEmail({ collection, token, req })

function hasTokenArg(args: unknown): args is { token: string } {
  return typeof args === 'object' && !!args
    && Object.prototype.hasOwnProperty.call(args, 'token')
    && typeof (args as { token: unknown }).token === 'string'
}

try {
  await payload.verifyEmail({ collection, token, req })
} catch (e) {
  if (e instanceof APIError && e.status === 400 && /Missing required data/.test(e.message)) {
    // prompt user / re-request verification email
  } else throw e
}

When it happens

Trigger: The verify endpoint is hit without a token path/param (e.g. `GET /api/<collection>/verify/` with no token segment, or a Local API call with `args` missing `token`); the route param failed to bind to `args.token`.

Common situations: Email link truncated/dropped the token; a custom route forwards the request without extracting the token param; the token is passed as `data` instead of as the top-level `token` arg.

Related errors

• Missing required data.
• Missing ${collectionConfig.auth.loginWithUsername ? 'usernam
• Username or email is required
• validation:required
• error:notAllowedToPerformAction

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/31dab6ed4c5d1202. Report an issue: GitHub.