schollz/croc · error

Invalid stored-transfer token

Error message

Invalid stored-transfer token

What it means

parseStoredShare() splits a croc-store-v1 token on '.' and requires exactly 4 segments: protocol, base64url origin, id, base64url key. Extra dots (e.g., inside a hostname-less or mis-pasted token) or missing segments produce this error before any segment is decoded.

Source

Thrown at web/src/protocol/stored.ts:177

  validateShare(share);
  return `${share.origin}/s/${share.id}#v1.${base64URL(share.key)}`;
}

export function formatStoredCLIToken(share: StoredShare) {
  validateShare(share);
  return [
    storedProtocol,
    base64URL(textEncoder.encode(share.origin)),
    share.id,
    base64URL(share.key),
  ].join(".");
}

export function parseStoredShare(value: string): StoredShare {
  const trimmed = value.trim();
  if (trimmed.startsWith(`${storedProtocol}.`)) {
    const parts = trimmed.split(".");
    if (parts.length !== 4) throw new Error("Invalid stored-transfer token");
    return validateShare({
      origin: textDecoder.decode(fromBase64URL(parts[1])),
      id: parts[2],
      key: fromBase64URL(parts[3]),
    });
  }
  const parsed = new URL(trimmed);
  const match = parsed.pathname.match(/^\/s\/([A-Za-z0-9_-]{22})$/);
  if (
    !match ||
    parsed.username ||
    parsed.password ||
    parsed.search ||
    !parsed.hash.startsWith("#v1.")
  ) {
    throw new Error("Invalid stored-transfer URL");
  }
  return validateShare({

View on GitHub (pinned to e25f1bdc04)

Solutions

1. Re-copy the token verbatim; ensure no trailing punctuation or adjacent text got included
2. Validate shape first: value.trim().startsWith("croc-store-v1.") && value.split(".").length === 4
3. Accept the browser URL form (https://host/s/<id>#v1.<key>) as the canonical paste format; it is dot-free

const isWellFormedToken = (v: string): boolean => v.trim().startsWith("croc-store-v1.") && v.trim().split(".").length === 4;

When it happens

Trigger: Calling parseStoredShare with a string starting with "croc-store-v1." whose split('.').length !== 4 — e.g. trailing period, an origin segment containing a literal '.', or a token truncated/concatenated with other text.

Common situations: Note that valid origins like "https://example.com" contain no dots after encoding? They do not (base64url alphabet has none), but a user pasting two tokens together, adding punctuation, or a markdown renderer auto-linking the token and appending a period all hit this.

Related errors

• Invalid stored-transfer id
• Invalid stored-transfer key
• Invalid stored-transfer URL
• Code must be at least 6 characters
• Custom codes must use printable ASCII characters

AI-assisted analysis of schollz/croc@e25f1bdc04 (2026-08-15). Data as JSON: /api/errors/6b6d5cf8c1fd7640. Report an issue: GitHub.