ruvnet/ruflo · error · TokenGeneratorError

NO_SECRET

NO_SECRET

Error message

HMAC secret required for signed tokens

What it means

TokenGenerator.generateSignedToken was called with no hmacSecret configured (the constructor defaulted it to empty string). Signed tokens derive their HMAC from that secret; without it a forged 'signature' would be meaningless, so the operation is refused with NO_SECRET.

Source

Thrown at v3/@claude-flow/security/src/token-generator.ts:230

      expiresAt: new Date(now.getTime() + expirationMinutes * 60 * 1000),
      attempts: 0,
      maxAttempts,
    };
  }

  /**
   * Generates a signed token using HMAC.
   *
   * @param payload - Data to include in token
   * @param expirationSeconds - Token expiration
   * @returns Signed token
   */
  generateSignedToken(
    payload: Record<string, unknown>,
    expirationSeconds?: number
  ): SignedToken {
    if (!this.config.hmacSecret) {
      throw new TokenGeneratorError(
        'HMAC secret required for signed tokens',
        'NO_SECRET'
      );
    }

    const expiration = expirationSeconds ?? this.config.defaultExpiration;
    const now = new Date();
    const expiresAt = new Date(now.getTime() + expiration * 1000);

    const tokenData = {
      ...payload,
      iat: now.getTime(),
      exp: expiresAt.getTime(),
      nonce: this.generate(8),
    };

    const token = Buffer.from(JSON.stringify(tokenData)).toString('base64url');
    const signature = this.sign(token);

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Provide an HMAC secret in the token generator configuration.
2. Use unsigned tokens only in contexts where integrity is not required.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/token-generator.ts:230 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/5458b68779ee4602. Report an issue: GitHub.