What causes "Token is not active (revoked or expired)" in zeroclaw-labs/zeroclaw?

Reject with 401 and have the client re-authenticate, or use its refresh token once and re-validate

Token is not active (revoked or expired)

Error message

Token is not active (revoked or expired)

What it means

The introspection endpoint answered 2xx with active = false (nevis.rs:201-203). Nevis considers the token inactive: revoked, expired, or not issued for this client/realm. This is a definitive negative answer from the IdP, not a network or parse problem.

Source

Thrown at crates/zeroclaw-runtime/src/security/nevis.rs:202

            .form(&form)
            .send()
            .await
            .context("Failed to reach Nevis introspection endpoint")?;

        if !resp.status().is_success() {
            bail!(
                "Nevis introspection returned HTTP {}",
                resp.status().as_u16()
            );
        }

        let body: IntrospectionResponse = resp
            .json()
            .await
            .context("Failed to parse Nevis introspection response")?;

        if !body.active {
            bail!("Token is not active (revoked or expired)");
        }

        let user_id = body
            .sub
            .filter(|s| !s.trim().is_empty())
            .context("Token has missing or empty `sub` claim")?;

        let mut roles = body.realm_access.map(|ra| ra.roles).unwrap_or_default();
        roles.sort();
        roles.dedup();

        Ok(NevisIdentity {
            user_id,
            roles,
            scopes: body
                .scope
                .unwrap_or_default()
                .split_whitespace()

View on GitHub (pinned to 88bb9c8533)

Solutions

Reject with 401 and have the client re-authenticate, or use its refresh token once and re-validate
If tokens die early, check the access token lifespan configured on the Nevis client
Confirm the token was issued by the same instance_url/realm the provider is configured with

Defensive patterns

Strategy: try-catch

Try / catch

Match err.to_string().contains("Token is not active") and return 401; invalidate any locally cached token for that caller and at most one refresh attempt before re-validating.

Prevention

Drop cached tokens on the first 401 instead of replaying them
Refresh tokens proactively before expected expiry
Use one Nevis realm per environment so cross-environment tokens fail predictably

When it happens

Trigger: validate_token with a revoked or expired access token; a token minted by a different realm or for a different client; a user logged out via the admin console so their token was revoked.

Common situations: Frontend kept a token in localStorage after logout; access-token lifespan shorter than the app session; staging token sent to the prod Nevis instance.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/c4fe58bb2e034adb. Report an issue: GitHub.