plandex-ai/plandex · error

error decoding auth token: %v

Error message

error decoding auth token: %v

What it means

After stripping 'Bearer ', GetAuthHeader base64-URL-decodes the remainder; a decode failure is wrapped with this message. The token payload is expected to be base64url-encoded JSON credentials (shared.AuthHeader).

Source

Thrown at app/server/handlers/auth_helpers.go:66

		log.Println("got auth header from cookie")
	}

	if authHeader == "" {
		return nil, nil
	}

	if !strings.HasPrefix(authHeader, "Bearer ") {
		return nil, fmt.Errorf("invalid auth header")
	}

	// strip off the "Bearer " prefix
	encoded := strings.TrimPrefix(authHeader, "Bearer ")

	// decode the base64-encoded credentials
	bytes, err := base64.URLEncoding.DecodeString(encoded)

	if err != nil {
		return nil, fmt.Errorf("error decoding auth token: %v", err)
	}

	// parse the credentials
	var parsed shared.AuthHeader
	err = json.Unmarshal(bytes, &parsed)

	if err != nil {
		return nil, fmt.Errorf("error parsing auth token: %v", err)
	}

	return &parsed, nil
}

func ClearAuthCookieIfBrowser(w http.ResponseWriter, r *http.Request) error {
	acceptHeader := r.Header.Get("Accept")
	if acceptHeader == "" {
		// no accept header, not a browser request
		return nil

View on GitHub (pinned to e2d772072e)

Solutions

1. Re-encode the credentials with base64.URLEncoding (RawURLEncoding if no padding) on the client
2. Check the token wasn't truncated or altered in transit (proxy header limits, copy/paste)
3. If a token from another system is being reused, re-issue a token minted by this app's own auth flow
4. Inspect the raw Authorization header server-side and compare its length/charset with the expected token
5. Clear stored/cookie tokens and re-authenticate

Example fix

// before
authHeader := base64.StdEncoding.EncodeToString(payload) // standard base64 (+, /, =)
// after
authHeader := base64.URLEncoding.EncodeToString(payload) // URL-safe alphabet

// client side, before sending
if _, err := base64.URLEncoding.DecodeString(encoded); err != nil {
    encoded = base64.URLEncoding.EncodeToString([]byte(rawPayload)) // re-encode properly
}

authHeader, err := GetAuthHeader(r)
if err != nil {
    if strings.HasPrefix(err.Error(), "error decoding auth token") { http.Error(w, "corrupt token, please sign in again", http.StatusUnauthorized); return }
    http.Error(w, err.Error(), http.StatusUnauthorized)
}

When it happens

Trigger: The Authorization header's Bearer value contains characters outside the base64url alphabet (spaces, '+', '/', '=' padding from standard base64, or truncation), so base64.URLEncoding.DecodeString fails.

Common situations: Client uses standard base64 instead of base64url encoding, token truncated by header length limits or a copy/paste error, cookie value mangled by a proxy, or manual token construction without proper encoding.

Related errors

• error parsing auth token: %v
• error loading accounts: %v
• error signing in to new account: %v
• error selecting account: %v
• error prompting for sign in to new account: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/adaf5e05336e6dc7. Report an issue: GitHub.