plandex-ai/plandex · error

no token

Error message

no token

What it means

SetAuthCookieIfBrowser resolves the token either from the Authorization header or from callers (e.g. ValidateAndSignIn, org handlers); if after all sources the token is still empty, it refuses to set the auth cookie and returns this error.

Source

Thrown at app/server/handlers/auth_helpers.go:182

	acceptHeader := r.Header.Get("Accept")
	if acceptHeader == "" {
		// no accept header, not a browser request
		log.Println("not a browser request")
		return nil
	}

	log.Println("is browser - setting auth cookie")

	if token == "" {
		authHeader, err := GetAuthHeader(r)
		if err != nil {
			return fmt.Errorf("error getting auth header: %v", err)
		}
		token = authHeader.Token
	}

	if token == "" {
		return fmt.Errorf("no token")
	}

	// set authToken cookie
	authHeader := shared.AuthHeader{
		Token: token,
		OrgId: orgId,
	}

	bytes, err := json.Marshal(authHeader)

	if err != nil {
		return fmt.Errorf("error marshalling auth header: %v", err)
	}

	// base64 encode
	token = base64.URLEncoding.EncodeToString(bytes)

	var domain string

View on GitHub (pinned to e2d772072e)

Solutions

1. Sign in first (SignInHandler) to obtain a token before calling flows that set the auth cookie
2. Ensure the client sends 'Authorization: Bearer <token>' on requests needing a session
3. Check that cookies are enabled/sent by the browser and not stripped by SameSite/domain settings
4. Verify the calling handler passes the token parameter instead of an empty string
5. Redirect unauthenticated users to login instead of calling this function

Example fix

// before
SetAuthCookieIfBrowser(w, r, "", orgId) // empty token → error
// after
if token == "" { http.Redirect(w, r, "/login", http.StatusUnauthorized); return }
SetAuthCookieIfBrowser(w, r, token, orgId)

// before calling
if token == "" {
    if ah, _ := GetAuthHeader(r); ah != nil { token = ah.Token }
}
if token == "" { http.Redirect(w, r, "/login", http.StatusSeeOther); return } // skip SetAuthCookieIfBrowser
SetAuthCookieIfBrowser(w, r, token, orgId)

err := SetAuthCookieIfBrowser(w, r, token, orgId)
if err != nil {
    if err.Error() == "no token" { http.Error(w, "not authenticated", http.StatusUnauthorized); return }
    http.Error(w, err.Error(), http.StatusInternalServerError)
}

When it happens

Trigger: A call path provides neither an Authorization header token nor an explicit token/orgId argument — e.g. ValidateAndSignIn invoked with no auth header present, or GetOrgSessionHandler called without any token in context/cookie.

Common situations: User not signed in yet hitting an endpoint that requires a token, expired/cleared cookie while the client also sends no Authorization header, or handler wiring that forgot to pass the token argument.

Related errors

• auth.Current.UserId is empty
• error loading accounts: %v
• error signing in to new account: %v
• error selecting account: %v
• error prompting for sign in to new account: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/5d2b0f22f57ff19d. Report an issue: GitHub.