plandex-ai/plandex · error

error parsing auth token: %v

Error message

error parsing auth token: %v

What it means

After successful base64 decoding, GetAuthHeader unmarshals the bytes into shared.AuthHeader; a JSON parse failure is wrapped with this message. The decoded payload must be valid JSON with the expected AuthHeader fields (Token, OrgId).

Source

Thrown at app/server/handlers/auth_helpers.go:74

		return nil, fmt.Errorf("invalid auth header")
	}

	// strip off the "Bearer " prefix
	encoded := strings.TrimPrefix(authHeader, "Bearer ")

	// decode the base64-encoded credentials
	bytes, err := base64.URLEncoding.DecodeString(encoded)

	if err != nil {
		return nil, fmt.Errorf("error decoding auth token: %v", err)
	}

	// parse the credentials
	var parsed shared.AuthHeader
	err = json.Unmarshal(bytes, &parsed)

	if err != nil {
		return nil, fmt.Errorf("error parsing auth token: %v", err)
	}

	return &parsed, nil
}

func ClearAuthCookieIfBrowser(w http.ResponseWriter, r *http.Request) error {
	acceptHeader := r.Header.Get("Accept")
	if acceptHeader == "" {
		// no accept header, not a browser request
		return nil
	}

	// Check for existing auth cookie
	_, err := r.Cookie("authToken")
	if err == http.ErrNoCookie {
		// No auth cookie, nothing to clear
		return nil
	}

View on GitHub (pinned to e2d772072e)

Solutions

1. Ensure the client encodes JSON of shared.AuthHeader ({"token":...,"orgId":...}) before base64url encoding, not a raw token string
2. Re-authenticate to obtain a freshly minted token in the current format
3. Check for version skew between services issuing and parsing tokens
4. Validate the decoded payload is JSON before sending (json.Valid on the plaintext)
5. Clear stale cookies/tokens and sign in again

Example fix

// before
encoded := base64.URLEncoding.EncodeToString([]byte(token)) // raw token, not JSON
// after
payload, _ := json.Marshal(shared.AuthHeader{Token: token, OrgId: orgId})
encoded := base64.URLEncoding.EncodeToString(payload)

// client side, before encoding
payload, err := json.Marshal(shared.AuthHeader{Token: token, OrgId: orgId})
if err != nil { return fmt.Errorf("cannot serialize auth header: %w", err) }
encoded := base64.URLEncoding.EncodeToString(payload)

authHeader, err := GetAuthHeader(r)
if err != nil {
    if strings.HasPrefix(err.Error(), "error parsing auth token") { http.Error(w, "unrecognized token format, sign in again", http.StatusUnauthorized); return }
    http.Error(w, err.Error(), http.StatusUnauthorized)
}

When it happens

Trigger: The base64 decodes fine but the plaintext is not valid JSON, or the JSON structure doesn't match shared.AuthHeader — e.g. a raw session token string (no JSON braces), wrong field names, or a token produced by a different/older format.

Common situations: Client passes an opaque token string instead of the encoded JSON credentials, version mismatch between token issuer and parser (schema change), or manual token crafting.

Related errors

• error decoding auth token: %v
• error loading accounts: %v
• error signing in to new account: %v
• error selecting account: %v
• error prompting for sign in to new account: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/3f6248463e905efc. Report an issue: GitHub.