token-type-mismatch When using multiple ```acceptsToken``` in ```authenticateRequest```

[skylineagle]

Preliminary Checks

• I have reviewed the documentation: https://clerk.com/docs

• I have searched for existing issues: https://github.com/clerk/javascript/issues

• I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)

• This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.

Reproduction

https://github.com/skylineagle/clerk-multiple-token-repro.git

Publishable key

pk_test_dXByaWdodC1nbmF0LTY0LmNsZXJrLmFjY291bnRzLmRldiQ

Description

Steps to reproduce:

1. Run the elyisa server in the repro
2. call the GET / endpoint using a valid api_key created for a clerk user
3. call the GET / endpoint using a valid session_token
4. see the session_token is invalid with token-type-mismatch

Expected behavior:

When multiple acceptsToekn are given all of them should be considered valid

Actual behavior:

only the api_key type is valid even with seesion_token also configured

Environment

System:
    OS: macOS 26.0.1
    CPU: (11) arm64 Apple M3 Pro
    Memory: 90.64 MB / 18.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 20.15.1 - /Users/eagle/.nvm/versions/node/v20.15.1/bin/node
    Yarn: 1.22.22 - /Users/eagle/.bun/bin/yarn
    npm: 10.7.0 - /Users/eagle/.nvm/versions/node/v20.15.1/bin/npm
    pnpm: 9.6.0 - /Users/eagle/Library/pnpm/pnpm
    bun: 1.3.3 - /Users/eagle/.bun/bin/bun
    Deno: 2.3.1 - /opt/homebrew/bin/deno                           Browsers:
    Safari: 26.0.1
  npmPackages:
    @ai-sdk/openai: ^2.0.77 => 2.0.77
    @arcjet/bun: ^1.0.0-beta.15 => 1.0.0-beta.15
    @arcjet/inspect: ^1.0.0-beta.15 => 1.0.0-beta.15
    @bogeychan/elysia-logger: ^0.1.10 => 0.1.10
    @braintrust/otel: ^0.1.2 => 0.1.2
    @clerk/backend: ^2.29.0 => 2.29.0
    @clerk/shared: ^3.41.1 => 3.41.1
    @elysiajs/cors: ^1.4.0 => 1.4.0
    @mem0/vercel-ai-provider: ^2.0.4 => 2.0.4
    @openrouter/ai-sdk-provider: ^1.5.3 => 1.5.3
    @opentelemetry/sdk-node: ^0.208.0 => 0.208.0                     @opentelemetry/sdk-trace-base: ^2.2.0 => 2.2.0
    @tqman/nice-logger: ^1.1.1 => 1.1.1
    @types/better-sqlite3: ^7.6.13 => 7.6.13
    @types/bun: ^1.3.3 => 1.3.3
    @vercel/otel: ^2.1.0 => 2.1.0
    ai: ^5.0.108 => 5.0.108
    better-auth: ^1.4.5 => 1.4.5
    braintrust: ^1.0.1 => 1.0.1
    dotenv: ^17.2.3 => 17.2.3
    elysia: ^1.4.18 => 1.4.18
    elysia-clerk: ^0.13.2 => 0.13.2
    gtfs-rb: ^1.2.8 => 1.2.8
    ky: ^1.14.1 => 1.14.1
    pino: ^10.1.0 => 10.1.0
    pino-pretty: ^13.1.3 => 13.1.3
    zod: ^4.1.13 => 4.1.13

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Possible Duplicates

• Nextjs auth() "does not exist" typescript error when array passed to acceptsToken #7452

Related Issues

• JS Backend SDK sessions.getToken method does not include expires_in_seconds parameter #6141
• @clerk/backend's getUserOauthAccessToken throws oauth_token_retrieval_error with TikTok provider after 24 hours #6302
• 500 Server Error #6198

👤 Suggested Assignees

• jameslshannon
• Laurens256
• thespacemanatee
• alamenai

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[wobsoriano]

Hello! I see you opened an issue on elysia-clerk's side already here wobsoriano/elysia-clerk#125

Closing this. Let's continue there!

[skylineagle]

the elysia clerk issue is not related to this issue, this seems like a bug in the @clerk/backend package