---
title: "MGS9019: invalid token record skipped"
description: A file in the token store holds a record no mint could have written, so it is skipped and verifies nothing, while every other token keeps working. Remove it and mint its replacement.
tags: [MGS9019, auth, token, store, tokens.d, doctor]
---

# MGS9019: invalid token record skipped

A file in `$XDG_STATE_HOME/magus/tokens.d` holds a record that
`magus config ... create` could never have written. The store skips that one
file: it verifies nothing, lists nowhere, and every other token keeps working.
`magus doctor` fails its `tokens` check naming the file, and the server logs it
once.

```text
[MGS9019] auth: token record /path/tokens.d/laptop.json is skipped: tokens=write
is the operator's alone; remove it (`rm /path/tokens.d/laptop.json`) and mint
its replacement
  see: .../MGS9019.md
```

## Why

A record is held at load to every rule a mint is held to, so a file planted in
`tokens.d`, by hand or by any process that can write there, cannot grant more
than one minted there. The rules:

- a stored token never holds `tokens=write`, which is the operator's alone, and
  grants something the grant model knows;
- it expires, after it was created, at most 366 days later (a link's one-time
  code: at most a minute);
- it was not created in the future;
- its name is the file's name, is a valid name, and does not look like an id;
- its id is the first 8 hex of a well-formed SHA-256.

The guard is a seatbelt here, not a boundary: a process running as you can write
the file whatever magus says. What magus enforces is that the file cannot
escalate once written.

## Resolution

Remove the file the message names and mint what it should have been:

```sh
rm <file>
magus config console token create --name <name>      # a browser
magus config mcp connector create --name <name>      # an MCP client
```

If you did not put the file there, treat the machine as untrusted until you
know what did.

## See also

- [Tokens and grants](../../../concepts/tokens.md)