schollz/croc · error · Error

Invalid stored-transfer id

Error message

Invalid stored-transfer id

What it means

validateShare() requires the share id to be exactly 22 characters of base64url ([A-Za-z0-9_-]), which is the canonical encoding of a 16-byte server-generated id. Any other length or character (a '+' or '/' from standard base64, a truncated id, extra whitespace inside the segment) fails.

Source

Thrown at web/src/protocol/stored.ts:149

    parsed.hostname === "127.0.0.1" ||
    parsed.hostname === "[::1]" ||
    parsed.hostname === "::1";
  if (
    (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) ||
    parsed.username ||
    parsed.password ||
    (parsed.pathname !== "/" && parsed.pathname !== "") ||
    parsed.search ||
    parsed.hash
  ) {
    throw new Error("Stored-transfer origin must contain only an HTTPS scheme and host");
  }
  return parsed.origin;
}

function validateShare(share: StoredShare) {
  if (!/^[A-Za-z0-9_-]{22}$/.test(share.id)) {
    throw new Error("Invalid stored-transfer id");
  }
  if (share.key.byteLength !== storedKeyBytes) {
    throw new Error("Invalid stored-transfer key");
  }
  share.origin = normalizeOrigin(share.origin);
  return share;
}

export function formatStoredBrowserURL(share: StoredShare) {
  validateShare(share);
  return `${share.origin}/s/${share.id}#v1.${base64URL(share.key)}`;
}

export function formatStoredCLIToken(share: StoredShare) {
  validateShare(share);
  return [
    storedProtocol,
    base64URL(textEncoder.encode(share.origin)),

View on GitHub (pinned to e25f1bdc04)

Solutions

1. Re-copy the full share token/URL from the sender; verify the id segment is exactly 22 chars with no +, /, or = characters
2. If you operate the storage service, emit 16-byte ids encoded as unpadded base64url
3. Use isStoredShareValue()/storedShareFromLocation() for soft detection instead of letting parseStoredShare throw

const isValidShareId = (id: string): boolean => /^[A-Za-z0-9_-]{22}$/.test(id);

When it happens

Trigger: parseStoredShare on a URL whose /s/ segment is not 22 base64url chars is caught earlier as "Invalid stored-transfer URL", so this fires mainly on the token branch (parts[2]) or on the client-generated share from createStoredUpload when the storage service returned a malformed id.

Common situations: Hand-crafted or truncated croc-store-v1 tokens; a third-party/proxy storage service that returns standard-base64 ids containing + or /; copy-paste losing characters at token segment boundaries.

Related errors

• Invalid stored-transfer key
• Invalid stored-transfer token
• Stored transfers can contain at most ${settings.maxFiles} fi
• Stored transfer exceeds the ${settings.maxTransferBytes} byt
• Duplicate filename: ${name}

AI-assisted analysis of schollz/croc@e25f1bdc04 (2026-08-15). Data as JSON: /api/errors/a7672243dba7a014. Report an issue: GitHub.