[Better Auth] auth.api.getAccessToken returns Uncaught APIError: Account not found

I have tried the following using google oauth

export const getAuthToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    const { userId } = await requireAuth(ctx);
    const auth = createAuth(ctx);
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
        userId,
      },
    });
    console.log(token)
    return token;
  },
});

export const getAuthToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    const { userId } = await requireAuth(ctx);
    const auth = createAuth(ctx);
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
        userId,
      },
    });
    console.log(token)
    return token;
  },
});

I have also tried using the betterauthcomponent and get the header and pass it along it returns Uncaught APIError: Failed to get a valid access token @erquhart

40 Replies

Convex Bot•2mo ago

Thanks for posting in <#1088161997662724167>. Reminder: If you have a Convex Pro account, use the Convex Dashboard to file support tickets. - Provide context: What are you trying to achieve, what is the end-user interaction, what are you seeing? (full error message, command output, etc.) - Use search.convex.dev to search Docs, Stack, and Discord all at once. - Additionally, you can post your questions in the Convex Community's <#1228095053885476985> channel to receive a response from AI. - Avoid tagging staff unless specifically instructed. Thank you!

erquhart•2mo ago

hmm researching Try with headers, without the userID You will absolutely need headers for any server side call to better auth I see you said "tried using the betterauthcomponent" - any Better Auth implementation not using the component would be out of scope for me, just fyi But if you're using the component and passing headers without the userId, it should work

Barrel Of LubeOP•2mo ago

Uncaught APIError: Failed to get a valid access token

export const getAuthToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    // const { userId } = await requireAuth(ctx);
    const auth = createAuth(ctx);
    const headers = await betterAuthComponent.getHeaders(ctx);
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
      },
      headers,
    });
    console.log(token)
    return token;
  },
});

export const getAuthToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    // const { userId } = await requireAuth(ctx);
    const auth = createAuth(ctx);
    const headers = await betterAuthComponent.getHeaders(ctx);
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
      },
      headers,
    });
    console.log(token)
    return token;
  },
});

erquhart•2mo ago

Can you log the headers before the request and make sure there's a better auth cookie in there

Barrel Of LubeOP•2mo ago

'{\n "_headersList": [\n [\n "authorization",\n "Bearer iFdF36qGyltxAdofayx833PRlRh8SUwl"\n ]\n ]\n}'

erquhart•2mo ago

That's a session token - can you look at the better auth session table in your convex dashboard and see if any have a token field matching that

Barrel Of LubeOP•2mo ago

{\n  "user": {\n    "name": "THAT\'S WHAT SHE SAID",\n    "email": "...@gmail.com",\n    "emailVerified": true,\n    "image": "https://lh3.googleusercontent.com/a/ACg8ocLq9cJZsSMoEhPiw5XOu8a4jRP_drJIA6gD8dp-s-NN1DegbA6v=s96-c",\n    "createdAt": 1752164746952,\n    "updatedAt": 1752164746952,\n    "id": "..."\n  },\n  "session": {\n    "expiresAt": 1752769547016,\n    "token": "...",\n    "createdAt": 1752164747016,\n    "updatedAt": 1752164747016,\n    "ipAddress": "...",\n    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36",\n    "userId": "...",\n    "id": "..."\n  }\n}

{\n  "user": {\n    "name": "THAT\'S WHAT SHE SAID",\n    "email": "...@gmail.com",\n    "emailVerified": true,\n    "image": "https://lh3.googleusercontent.com/a/ACg8ocLq9cJZsSMoEhPiw5XOu8a4jRP_drJIA6gD8dp-s-NN1DegbA6v=s96-c",\n    "createdAt": 1752164746952,\n    "updatedAt": 1752164746952,\n    "id": "..."\n  },\n  "session": {\n    "expiresAt": 1752769547016,\n    "token": "...",\n    "createdAt": 1752164747016,\n    "updatedAt": 1752164747016,\n    "ipAddress": "...",\n    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36",\n    "userId": "...",\n    "id": "..."\n  }\n}

export const getAuthToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    const auth = createAuth(ctx);
    const headers = await betterAuthComponent.getHeaders(ctx);
    const session = await auth.api.getSession({
      headers,
    });
    console.log(JSON.stringify(session, null, 2))
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
      },
      headers,
    });
    console.log(token)
    return token;
  },
});

export const getAuthToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    const auth = createAuth(ctx);
    const headers = await betterAuthComponent.getHeaders(ctx);
    const session = await auth.api.getSession({
      headers,
    });
    console.log(JSON.stringify(session, null, 2))
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
      },
      headers,
    });
    console.log(token)
    return token;
  },
});

erquhart•2mo ago

hmm sounds like it's Google that's having a problem specifically

Barrel Of LubeOP•2mo ago

hmm

erquhart•2mo ago

(maybe) you're on the latest @convex-dev/better-auth right

Barrel Of LubeOP•2mo ago

yep

barrel@MSI:~/zerobs$ npm list @convex-dev/better-auth
zerobs@ /home/barrel/zerobs
└── @convex-dev/better-auth@0.6.2

barrel@MSI:~/zerobs$ npm list @convex-dev/better-auth
zerobs@ /home/barrel/zerobs
└── @convex-dev/better-auth@0.6.2

erquhart•2mo ago

0.7.0 just dropped, update and see if that fixes

Barrel Of LubeOP•2mo ago

when i jus did a fresh install of node modules today

erquhart•2mo ago

https://discord.com/channels/1019350475847499849/1365754331873415440/1392921192154923169

Barrel Of LubeOP•2mo ago

lol

erquhart•2mo ago

just dropped

Barrel Of LubeOP•2mo ago

am not able to login in at all with .7 it works fine if i revert it to 6.. nvm, lemme debug a lil more n update

erquhart•2mo ago

Did you do the migration steps

Barrel Of LubeOP•2mo ago

i jus cleared all tables am still on dev rn am not able to push for sm reason, i even reverted back to a prev commit

✖ Error: Unable to start push to https://....convex.cloud
✖ Error fetching POST  https:///api/deploy2/start_push 400 Bad Request: InvalidModules: Hit an error while pushing:
Loading the pushed modules encountered the following
    error:
Uncaught unhandledRejection: Cannot read properties of undefined (reading 'log')

✖ Error: Unable to start push to https://....convex.cloud
✖ Error fetching POST  https:///api/deploy2/start_push 400 Bad Request: InvalidModules: Hit an error while pushing:
Loading the pushed modules encountered the following
    error:
Uncaught unhandledRejection: Cannot read properties of undefined (reading 'log')

erquhart•2mo ago

Yeah not sure what to say on that. the only .log calls we have is console.log. Guessing console is defined.

Barrel Of LubeOP•2mo ago

idk, i commented out the convex .env.local created a new cloud instance, copy pasted my envs and it works istg i even tried reverting back, restarting my pc, network, nothing worked

export const getToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    const auth = await createAuth(ctx);
    const headers = await betterAuthComponent.getHeaders(ctx);
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
      },
      headers,
    });
    return { token: token.accessToken, scopes: token.scopes };
  },
});

export const getToken = query({
  args: {
    providerId: v.string(),
  },
  handler: async (ctx, args) => {
    const auth = await createAuth(ctx);
    const headers = await betterAuthComponent.getHeaders(ctx);
    const token = await auth.api.getAccessToken({
      body: {
        providerId: args.providerId,
      },
      headers,
    });
    return { token: token.accessToken, scopes: token.scopes };
  },
});

log:

7/10/2025, 2:16:14 PM [CONVEX A(langchain/index:chat)] [LOG] {
  scopes: [
    'https://www.googleapis.com/auth/userinfo.profile',
    'https://www.googleapis.com/auth/calendar.readonly',
    'https://www.googleapis.com/auth/gmail.modify',
    'https://www.googleapis.com/auth/calendar.events',
    'https://www.googleapis.com/auth/gmail.compose',
    'https://www.googleapis.com/auth/gmail.send',
    'openid',
    'https://www.googleapis.com/auth/userinfo.email',
    'https://www.googleapis.com/auth/gmail.readonly'
  ],
  token: '....'
}
7/10/2025, 2:16:36 PM [CONVEX A(langchain/index:chat)] Your request couldn't be completed. Try again later.

7/10/2025, 2:16:14 PM [CONVEX A(langchain/index:chat)] [LOG] {
  scopes: [
    'https://www.googleapis.com/auth/userinfo.profile',
    'https://www.googleapis.com/auth/calendar.readonly',
    'https://www.googleapis.com/auth/gmail.modify',
    'https://www.googleapis.com/auth/calendar.events',
    'https://www.googleapis.com/auth/gmail.compose',
    'https://www.googleapis.com/auth/gmail.send',
    'openid',
    'https://www.googleapis.com/auth/userinfo.email',
    'https://www.googleapis.com/auth/gmail.readonly'
  ],
  token: '....'
}
7/10/2025, 2:16:36 PM [CONVEX A(langchain/index:chat)] Your request couldn't be completed. Try again later.

this works, current config

erquhart•2mo ago

Works as in google auth is working too

Barrel Of LubeOP•2mo ago

ok i might have to escalate the issue

✖ Error: Unable to start push to https://....convex.cloud
✖ Error fetching POST  https://....convex.cloud/api/deploy2/start_push 400 Bad Request: InvalidModules: Hit an error while pushing:
Loading the pushed modules encountered the following
    error:
Uncaught unhandledRejection: Cannot read properties of undefined (reading 'log')

✖ Error: Unable to start push to https://....convex.cloud
✖ Error fetching POST  https://....convex.cloud/api/deploy2/start_push 400 Bad Request: InvalidModules: Hit an error while pushing:
Loading the pushed modules encountered the following
    error:
Uncaught unhandledRejection: Cannot read properties of undefined (reading 'log')

the deployment seems to be failing when I abort an action using abortcontroller after a console.log should i use the support or jus ping jamie/wayne here?

jamwt•2mo ago

@Barrel Of Lube feel free to create a support ticket. that's the way to ensure things 100% get solved

Barrel Of LubeOP•2mo ago

it works if u give it some time to recover is it normal to get 200ms latency for auth verification wth better auth?

Barrel Of LubeOP•2mo ago

HTTP auth endpoint have around 200ms latency wth better auth

Barrel Of LubeOP•2mo ago

my prev prod wth convex auth

jamwt•2mo ago

@erquhart ^

erquhart•3w ago

Yeah, it’s high right now because the better auth db calls are all separate Convex functions. Running the whole thing in a single query/mutation is on the roadmap for next release to take this down. @Barrel Of Lube circling back here - realizing that running entire Better Auth endpoint calls in a single transaction, which was the plan for reducing the time of these functions, has two problems: 1. There's no way to get your Better Auth config into a mutation in the component. I was hoping we could work around this, but it's a fundamental part of component isolation - nothing can get into those functions unless they're present at bundle time, similar to your app's Convex functions. 2. The cached responses from sub queries are already absorbing some of the inefficiency, and queries represent the bulk of the internal requests. Which means it's less clear whether this will meaningfully improve times. It may, just hard to say how much. That said, the numbers in your screenshot are in the same range as what you would see from Convex Auth, which isn't doing subqueries and isn't running all of Better Auth (which I suspected may have been another major culprit here, seems like it's not). Oh you posted comparison numbers! Your numbers are pretty different from what I've seen in other implementations, hmm

Barrel Of LubeOP•3w ago

erquhart•3w ago

Those are really fast, this is interesting. I'm going to try a fresh install.

Barrel Of LubeOP•3w ago

https://github.com/0bs-chat/zerobs/blob/main/convex/auth.ts

Barrel Of LubeOP•3w ago

one of my most painful setbacks, had to cut down so many features

erquhart•3w ago

:sad-cowboy: yeah still messing with numbers to figure out what's actually happening

Barrel Of LubeOP•2w ago

@erquhart can we do something like - serve /.well-known/openid-configuration and JWKS directly as lightweight HTTP routes (no auth.handler, no redirect), with cache headers - remove the redirect for discovery - externalize keys (env/secret) so JWKS can be returned statically and match what signs tokens

erquhart•2w ago

It looks like http action perf is affected by component usage currently, so getting the key won’t be sped up by storing it statically. That still needs to be looked into. We can do customJwt to get rid of the oidc discovery call, though.

Barrel Of LubeOP•2w ago

also can you check the latency for convexAdapter, if its not much < 50ms on avg, then i supoose we can make the better auth instance singleton as well

erquhart•2w ago

The adapter primarily runs Convex functions in the component space, so it's execution time is impacted by a number of things. The Better Auth instance is a singleton when accessed through http action calls, which applies to the numbers you're focused on, let me know if I'm missing your point there.

Barrel Of LubeOP•2w ago

Yep I found the instance I don’t see any other way to solve it rn, first 2 suggestions are somewhat of an alternative medicine typaa fix

erquhart•2w ago

Getting rid of the oidc discovery call will have concrete impact at least. I'll look at that soon.

[Better Auth] auth.api.getAccessToken returns Uncaught APIError: Account not found

Did you find this page helpful?