# I am having issues with the token

## post by Farah_Abdulwahab on Apr 14, 2025

Hello, the token is returning as 350 characters, whereas it should be 240 from the documentation, how can I fix this?

## post by neil on Apr 14, 2025

Hi [@Farah_Abdulwahab](https://community.assembly.com/u/farah_abdulwahab) thanks for asking. Can you clarify which documentation you are referring to that specifies length of token? We would to be happy to take a look to understand what might be going on here.

## post by neil on Apr 14, 2025

Thanks for clarifying this. The token you are seeing in the docs is an example, the length will not always been fixed and has some variability based on the token payload.

The easiest way to decrypt the token is to our node sdk. Have you tried this already? Using that is one line to get the token payload: `const tokenObject = await copilot.getTokenPayload();`

We’ve put together a few examples on how to implement this. Checkout the [custom-app base](https://github.com/copilot-platforms/custom-app-base). This example uses NextJS and can be quickly deployed on Vercel. If you have a different stack/setup there might be some small changes.

Here is a specific part of the custom-app-base where there is an example of accessing the token from the query param and to find the session information: [link](https://github.com/copilot-platforms/custom-app-base/blob/2531f774ce7691cfa579c05fecc106c47f3b0f7d/src/app/(home)/home.tsx#L14).

## post by Farah_Abdulwahab on Apr 14, 2025

I’m currently building a separate system using Node.js with Express, and it runs independently from the main Copilot app. I’m passing the token (from Copilot) via the URL to my site, and then forwarding it to this standalone Node.js server to decode it using the SDK method `copilot.getTokenPayload()`.

However, I’m consistently getting an unauthorized token response.

Just to clarify:

My primary backend is Python-based (not Node.js).

I pass the token from Copilot to my site (hosted separately), and from there to the new Node.js project for decoding.

This Node.js project is not part of the main Copilot app and runs on a different domain.

The decoding step always fails with an unauthorized error.

Could this issue be due to the fact that the Node.js project is not recognized as the main Copilot backend or isn’t hosted under the same domain/origin?

Is there a requirement that the token must be decoded from within the same project/environment (e.g., domain-bound or session-aware)? If there’s any documentation around how token verification works in custom setups like this — outside the default Next.js/Vercel environment — I’d really appreciate it.

## post by neil on Apr 14, 2025

[@Farah_Abdulwahab](https://community.assembly.com/u/farah_abdulwahab) you’ve got the right idea here and one thing I wanted to confirm is that you have set `COPILOT_API_KEY` env variable to the api key that was provided at the time you created the app. If that is not set or is using a different key you will get an unauthorized error.

```php
const copilot = copilotApi({
    apiKey: process.env.COPILOT_API_KEY,
    token: token,
});
```

How you set this env var really depends on your project. Without knowing the specifics the two most natural places I can say:

1. If you are using a managed service to run the NodeJs/Express app you may have to set this environment variable there. This is most likely.
2. If you have some deploy system, then it’s possible there is some place to set env variables there.

## post by Farah_Abdulwahab on Apr 16, 2025

A successful method I found was using the `copilot-node-sdk` and the `copilotApi` to get data from the token using the `getTokenPayload` function. However, there is still an issue: the token we use to decode is just a static token from our backend. Specifically, this token:

```ini
token_string = "945877eda264060760a687954bc1b421b542b222fefd1b938e0fb6273be3a4d99322e947622dfd41405dabb48042dc1e22ba85f555a65f967070a2cdc7c0b9a43b2b0a766dc7480417b71328f65aacf0659f8724cd563193e68ac5bb8a163703c4702f37182cf89f0a4079300a53f81d"
```

This token can be decoded, but other tokens cannot. This suggests that the token in the iframe is not passing correctly. any thoughts?

## post by Farah_Abdulwahab on Apr 16, 2025

Can thoughts on above?

## post by neil on Apr 16, 2025

That’s great to hear that you were able to decode the value. The approach you describe is exactly what I would suggest.

I’m not sure what you mean by just a static token. The token that gets passed to your app is generated dynamically using the API key for the app. If you are finding that the token received in your app can’t be decoded then the issue is likely that you are not using the correct API key.

Can share the code of how you have set up your app to decode the token? Please do not share sensitive information like the API key and leave that out.

## post by Farah_Abdulwahab on Apr 16, 2025

```auto
import express from 'express';
import bodyParser from 'body-parser';
import { copilotApi } from 'copilot-node-sdk';

const app = express();
app.use(bodyParser.json());

process.env.COPILOT_DEBUG = 'true';
process.env.COPILOT_ENV = 'local';

app.post('/decode_token', async (req, res) => {
  const token = req.body.token;
  try {
    const copilot = copilotApi({
      apiKey: process.env.COPILOT_API_KEY,
      token: token,
    });
    console.log('====================================');
    console.log(copilot);
    console.log('====================================');
    const tokenPayload = await copilot.getTokenPayload();
    console.log('Successfully decoded token:', tokenPayload);

return res.status(200).json({
      success: true,
      payload: tokenPayload,
    });
  } catch (error) {
    console.error('Failed to decode token:', error);
    return res.status(400).json({
      success: false,
      error: 'Failed to decode token',
      message: error.message,
    });
  }
});

const PORT = 5000;
app.listen(PORT, () => {
  console.log(`Token decoder server running on http://localhost:${PORT}`);
});
```

## post by neil on Apr 16, 2025

Thanks, a few things come to mind.

1. Can you share how you are calling this endpoint that you’ve setup. Specifically, I would like to confirm how you are passing the token in the request body.
2. Can you confirm where you got the value for the API key to set the env var value. If the token is passed in correctly but cannot be decoded than more than likely the API key being used is incorrect.
3. Last can you share the error you see in the `console.error('Failed to decode token:', error)` line.

## post by Farah_Abdulwahab on Apr 16, 2025

This example requests this code which is parsed from the copilot iframe.

```rust
curl --location 'http://localhost:5000/decode_token' \
--header 'Content-Type: application/json' \
--data '{"token":"2b808a4c61cc878d95277cb2aaaa9ae9b5d777907b07510ca925a7fc852773e9cbc1a9f105f5c04b85fa571b9e051f6e0705586de7fe0f5b34b8cf24657e6fc7c68af0f09d1051c6768d5ad990ad811e91ee28ce5a9117cd37ae5a7a825cb89e1471e3a40b2312da06845f7b9318b70986a989f732aea9dcc2e289eadb043a0dbdc23cbbfe92b7200732e118df1360c757a677e2683734394d8ee8fdbb26d0aa"}'
```

## post by neil on Apr 16, 2025

I deleted the second message you shared above because it showed your API key in the error logs.

Based on what you’ve shared above, the issue you are facing is very likely that the API KEY you have set in the env vars is NOT the same as the API key for this app. Each custom app you add in your workspace has a different API key. The token that’s provided is signed with the specific key for that app and so the same key needs to be used when decrypting. If you don’t have the API key you will have to re-add the app in your workspace and you will be presented with a new key that you can use.

## post by Farah_Abdulwahab on Apr 16, 2025

got it, will do and thank you.

## post by Farah_Abdulwahab on Apr 16, 2025

I created a new token, as shown in the image, called "decode." However, I cannot decode the token sent by Copilot. Is it because it is not the same token used by Copilot? If so, how can I create a new token and use it on both Copilot and the decode side (SDK NodeJS)?

## post by neil on Apr 16, 2025

The “token” you have created called decode is a new API Key that is not the same as an app API key that you need to decode a token passed to the app.

To create an API key for the app you want to follow the instructions on [setting up your first app](https://docs.copilot.app/docs/custom-apps-setting-up-your-first-app#step-2-register-your-app-and-get-an-api-key) and use the API key generated here in your env variables.

Keep in mind the token you were using previously **won’t** work with this API key. You will have to get the token by viewing the new app that you added.