ruvnet/RuView · error · anyhow::Error

HOMECORE_TOKENS is required; use --insecure-dev-auth only fo

Error message

HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development

What it means

Fail-fast bail in main(): the server refuses to start when the HOMECORE_TOKENS environment variable is unset or empty (checked via trim) and --insecure-dev-auth was not passed. This is a deliberate authentication guard -- either provision real long-lived bearer tokens (loaded by LongLivedTokenStore::from_env) or explicitly acknowledge an isolated dev setup with --insecure-dev-auth.

Source

Thrown at v2/crates/homecore-server/src/main.rs:190

    /// Durable controller pairing database.
    #[arg(
        long,
        env = "HOMECORE_HAP_PAIRING_STORE",
        default_value = ".homecore/hap/pairings.json"
    )]
    hap_pairing_store: std::path::PathBuf,
}

#[tokio::main]
async fn main() -> Result<()> {
    init_tracing();
    let mut cli = Cli::parse();
    let has_tokens = std::env::var("HOMECORE_TOKENS")
        .map(|value| !value.trim().is_empty())
        .unwrap_or(false);
    if !has_tokens && !cli.insecure_dev_auth {
        anyhow::bail!(
            "HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development"
        );
    }
    let tokens = if has_tokens {
        let store = LongLivedTokenStore::from_env();
        info!(
            "Provisioned {} bearer token(s) from HOMECORE_TOKENS",
            store.len().await
        );
        store
    } else {
        warn!(
            "Insecure development authentication enabled: any non-empty bearer token is accepted"
        );
        LongLivedTokenStore::allow_any_non_empty()
    };

    info!(

View on GitHub (pinned to 4685618388)

Solutions

1. Set HOMECORE_TOKENS to one or more non-empty bearer token values before starting the server
2. Check how the variable reaches the process: systemd EnvironmentFile, docker -e / compose environment, or shell export -- verify with 'tr : "\n" < /proc/$PID/environ | grep HOMECORE' style checks that it is non-empty
3. For isolated local development only, start with --insecure-dev-auth (never in production or on shared networks)
4. Mint the tokens per the project's token-provisioning docs so clients authenticate with them as Bearer credentials

Example fix

# before
systemctl start homecore-server
# Error: HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development

# after (unit file)
[Service]
EnvironmentFile=/etc/homecore/tokens.env   # HOMECORE_TOKENS=<non-empty token(s)>
ExecStart=/usr/local/bin/homecore-server

#!/usr/bin/env bash
if [[ -z "${HOMECORE_TOKENS// /}" ]]; then
  echo 'HOMECORE_TOKENS is empty or unset; refusing to start (dev only: add --insecure-dev-auth)' >&2
  exit 1
fi
exec homecore-server "$@"

fn auth_configured(tokens_env: Option<String>, insecure_dev_auth: bool) -> bool {
    insecure_dev_auth || tokens_env.is_some_and(|v| !v.trim().is_empty())
}

When it happens

Trigger: Starting the server with HOMECORE_TOKENS unset; setting it to an empty string or whitespace only (trims to empty and counts as missing); deployment env files not loaded (systemd EnvironmentFile missing, .env not sourced); CI/containers launched without the variable.

Common situations: New deployments that have not minted tokens yet; systemd units where EnvironmentFile= points to a missing file; quoting mistakes leaving the variable empty (HOMECORE_TOKENS=''); scripts copied between environments dropping the export.

Related errors

• invalid automations file {}: {e}
• MCP repository access requires a trusted root configured at
• JWT authentication is not configured. In development mode, e
• JWT authentication is not configured. Configure JWT_SECRET a
• Endpoint not available in production

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/f62ca4b57cd573c3. Report an issue: GitHub.