transloadit/uppy · error · Error

Missing token payload for provider ${providerName}

Error message

Missing token payload for provider ${providerName}

What it means

After parsing the auth token, verifyEncryptedAuthToken requires an object that has the specific providerName as an own property (Object.hasOwn). If the stored token map lacks an entry for that provider (e.g. token contains dropbox but the request needs googledrive), it throws 'Missing token payload for provider ${providerName}'.

Source

Thrown at packages/@uppy/companion/src/server/helpers/jwt.ts:81

  secret: EncryptionSecret,
) => {
  const ret = verifyJwtToken(decrypt(token, secret), secret)
  if (!ret) throw new Error('No payload')
  return ret
}

export const verifyEncryptedAuthToken = <T extends Record<string, unknown>>(
  token: string,
  secret: EncryptionSecret,
  providerName: string,
): T => {
  const json = verifyEncryptedToken(token, secret)
  if (typeof json !== 'string') {
    throw new Error('Invalid token payload: expected string')
  }
  const tokens: T = JSON.parse(json)
  if (!isRecord(tokens) || !Object.hasOwn(tokens, providerName))
    throw new Error(`Missing token payload for provider ${providerName}`)
  return tokens
}

function getCommonCookieOptions({
  companionOptions,
}: {
  companionOptions: CompanionRuntimeOptions
}): Record<string, unknown> {
  const cookieOptions: Record<string, unknown> = {
    httpOnly: true,
  }

  // Fix to show thumbnails on Chrome
  // https://community.transloadit.com/t/dropbox-and-box-thumbnails-returning-401-unauthorized/15781/2
  // Note that sameSite cookies also require secure (which needs https), so thumbnails don't work from localhost
  // to test locally, you can manually find the URL of the image and open it in a separate browser tab
  if (companionOptions.server && companionOptions.server.protocol === 'https') {
    cookieOptions['sameSite'] = 'none'

View on GitHub (pinned to 5d4dedd02a)

Solutions

1. Use the auth token generated for the same provider being accessed
2. Re-authenticate with the target provider so its token is included in the stored payload
3. When composing tokens manually, include every needed provider key in the map

Example fix

// before
const token = generateEncryptedAuthToken({ dropbox: dbxToken }, secret)
fetch('/drive/list', { headers: { 'uppy-auth-token': token } }) // googledrive route

// after
const token = generateEncryptedAuthToken({ googledrive: gdToken }, secret)
fetch('/drive/list', { headers: { 'uppy-auth-token': token } })

const tokens = JSON.parse(decodedPayload)
if (!Object.hasOwn(tokens, providerName)) throw new Error(`client precheck: no token for ${providerName}`)

const hasProviderToken = (t: unknown, p: string): t is Record<string, unknown> =>
  typeof t === 'object' && t !== null && Object.hasOwn(t, p);

try { await providerApi.call() } catch (err) {
  if (err.message.startsWith('Missing token payload for provider')) { /* re-auth that provider */ }
}

When it happens

Trigger: Calling a provider endpoint (e.g. /drive/list) with a companionAuthToken that was created for a different provider, or after the provider entry was never stored in the token.

Common situations: Sharing/reusing one provider's token for another provider's routes, stale tokens from before additional providers were added, or custom flows that build the token map with a subset of providers.

Related errors

• Invalid token payload
• No payload
• Invalid token payload: expected string
• Could not load authentication data required for third-party
• Missing S3 object key for aborting upload

AI-assisted analysis of transloadit/uppy@5d4dedd02a (2026-08-28). Data as JSON: /api/errors/1cb588beea851583. Report an issue: GitHub.