twentyhq/twenty · warning · Error

No getAuthTokensFromSSOExchangeToken result

Error message

No getAuthTokensFromSSOExchangeToken result

What it means

Thrown by useRedeemSSOExchangeToken (useRedeemSSOExchangeToken.ts:31-36) when the getAuthTokensFromSSOExchangeToken GraphQL mutation returns no data on the getAuthTokensFromSSOExchangeToken field. This typically means the ssoExchangeToken was invalid, expired, or already consumed. The thrown error is caught in the same hook and surfaced as an error snack bar.

Source

Thrown at packages/twenty-front/src/modules/auth/hooks/useRedeemSSOExchangeToken.ts:34

  );
  const [getAuthTokensFromSSOExchangeToken] = useMutation(
    GetAuthTokensFromSsoExchangeTokenDocument,
  );

  const redeemSSOExchangeToken = useCallback(
    async (ssoExchangeToken: string) => {
      // Keeps PageChangeEffect from consuming returnToPath mid token swap, and
      // drops any stale pair so the resume waits for the one being redeemed
      setIsAppEffectRedirectEnabled(false);
      setTokenPair(null);

      try {
        const { data } = await getAuthTokensFromSSOExchangeToken({
          variables: { ssoExchangeToken },
        });

        if (!isDefined(data?.getAuthTokensFromSSOExchangeToken)) {
          throw new Error('No getAuthTokensFromSSOExchangeToken result');
        }

        setTokenPair(data.getAuthTokensFromSSOExchangeToken.tokens);
      } catch (error: unknown) {
        enqueueErrorSnackBar(
          CombinedGraphQLErrors.is(error)
            ? { apolloError: error }
            : { message: error instanceof Error ? error.message : undefined },
        );
      } finally {
        setIsAppEffectRedirectEnabled(true);
      }
    },
    [
      getAuthTokensFromSSOExchangeToken,
      setTokenPair,
      setIsAppEffectRedirectEnabled,
      enqueueErrorSnackBar,

View on GitHub (pinned to 1f5dd2bbd2)

Solutions

1. Re-initiate the SSO login flow from the IdP to obtain a fresh exchange token.
2. Verify the exchange token arrives unmodified in the redirect URL query string.
3. Check server logs for getAuthTokensFromSSOExchangeToken rejection reasons (token expired vs. invalid).
4. Ensure clocks are synced between client and server to avoid premature expiry.

// The hook already wraps this in try/catch and surfaces a snack bar.
// To add custom recovery:
try {
  await redeemSSOExchangeToken(token);
} catch (err) {
  if (err.message === 'No getAuthTokensFromSSOExchangeToken result') {
    // redirect the user back to the SSO login entry point
  }
}

When it happens

Trigger: SSO login flow where the exchange token (passed via the redirect URL) is rejected by the server: data.getAuthTokensFromSSOExchangeToken is null/undefined, so the inner check fails.

Common situations: User revisits an old SSO redirect link whose token was already consumed; clock skew causing premature token expiry; IdP configuration mismatch; network/apollo error masking the field to null; the exchange token was tampered with.

Related errors

• Failed to create record
• ${currentUserResult.error.message}
• Email and password are required
• Field ${fieldMetadata.name} is missing, please refresh the p
• Failed to merge records

AI-assisted analysis of twentyhq/twenty@1f5dd2bbd2 (2026-08-12). Data as JSON: /api/errors/ad852b7af8aade1c. Report an issue: GitHub.