From fbae66de8af6cb1ba7333bd7008b7fd43c9fda23 Mon Sep 17 00:00:00 2001
From: martmull <martmull@hotmail.fr>
Date: Wed, 27 May 2026 18:30:14 +0200
Subject: [PATCH] Fix error when token invalid (#20972)

## Before

<img width="914" height="519" alt="image"
src="https://github.com/user-attachments/assets/8933bf9e-d8db-4670-ad08-69e900083fc1"
/>

## After

<img width="1105" height="523" alt="image"
src="https://github.com/user-attachments/assets/d8638dbb-adee-4b7d-9d29-1a2a0185ab4f"
/>
---
 .../engine/core-modules/jwt/services/jwt-wrapper.service.ts  | 5 ++++-
 .../suites/rest-api-core-authentication.integration-spec.ts  | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/packages/twenty-server/src/engine/core-modules/jwt/services/jwt-wrapper.service.ts b/packages/twenty-server/src/engine/core-modules/jwt/services/jwt-wrapper.service.ts
index d4b271c0d9..c3218efc08 100644
--- a/packages/twenty-server/src/engine/core-modules/jwt/services/jwt-wrapper.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/jwt/services/jwt-wrapper.service.ts
@@ -137,7 +137,10 @@ export class JwtWrapperService {
     const payload = this.decode<JwtPayload>(token, { json: true });
 
     if (!isDefined(payload)) {
-      throw new AuthException('No payload', AuthExceptionCode.UNAUTHENTICATED);
+      throw new AuthException(
+        'Token invalid.',
+        AuthExceptionCode.UNAUTHENTICATED,
+      );
     }
 
     const { key, algorithm } = await this.resolveVerificationKey(token);
diff --git a/packages/twenty-server/test/integration/rest/suites/rest-api-core-authentication.integration-spec.ts b/packages/twenty-server/test/integration/rest/suites/rest-api-core-authentication.integration-spec.ts
index ce4c8d3a59..926d4d8f46 100644
--- a/packages/twenty-server/test/integration/rest/suites/rest-api-core-authentication.integration-spec.ts
+++ b/packages/twenty-server/test/integration/rest/suites/rest-api-core-authentication.integration-spec.ts
@@ -27,7 +27,7 @@ describe('Core REST API Authentication', () => {
       });
   });
 
-  it('should return an Unauthenticated when no token is provided', async () => {
+  it('should return an Unauthenticated when a malformed token is provided', async () => {
     await makeRestAPIRequest({
       method: 'post',
       path: `/people`,
@@ -36,7 +36,7 @@ describe('Core REST API Authentication', () => {
       .expect(401)
       .expect((res) => {
         expect(res.body.error).toBe('UNAUTHENTICATED');
-        expect(res.body.messages[0]).toBe('No payload');
+        expect(res.body.messages[0]).toBe('Token invalid.');
       });
   });