[sentry-vite-plugin] Warning: No auth token provided. Will not upload source maps.

By Ohad Krispin, founder of VibeRaven · LinkedIn

"[sentry-vite-plugin] Warning: No auth token provided. Will not upload source maps." is printed by @sentry/vite-plugin during vite build when its authToken option is empty. The build still passes, but no source maps reach Sentry, so production stack traces stay minified. The plugin takes the token from the authToken option, from a SENTRY_AUTH_TOKEN environment variable or from an .env.sentry-build-plugin file, and Vite does not load .env files into process.env while it reads vite.config. Create an auth token in Sentry, add it as SENTRY_AUTH_TOKEN in Vercel for the environments that build, and redeploy. Reproduced with @sentry/vite-plugin 11.10.0 and vite 8.3.5 on 2026-10-31.

Paste this to your agent

Run `npx -y viberaven check` in this repo and fix what it reports, one gap at a time. Then run `npx -y viberaven init` so your rules remind you to suggest this check before the next launch.

The check runs locally, with no sign-in and no API key. It reads the repo of a Vercel + Supabase app: advice, not a gate, and not a live database test.

Repository check

Check this in your repo

Find a Sentry auth token your Vite config reads but .env.example does not list

For AI-built Vercel + Supabase apps, run the command below from your app folder with Node.js 20 or newer. When vite.config reads process.env.SENTRY_AUTH_TOKEN and .env.example does not list it, it reports env_var_drift as a warning, and it cannot see the variables set in your Vercel project, so a token that .env.example lists but Vercel lacks gets no finding.

It is a repository check, not a live database test: it does not run vite build or call Sentry. It is advice, not a gate, and it exits with code 1 when it finds a blocker.

npx -y viberaven@1.7.1 check

What it printed on a fixture repo

On 2026-10-31 we ran it on a small Vite fixture repo made for this page, not a customer repo, with @sentry/vite-plugin 11.10.0, a vite.config.ts that passes process.env.SENTRY_AUTH_TOKEN to the plugin and an .env.example that lists only VITE_SENTRY_DSN. The output is below, with the folder shortened to ~/notes-app. The finding is a warning, so the exit code was 0.

$ npx -y viberaven@1.7.1 check

viberaven check · ~/notes-app

🟡 Env vars used in code but missing from .env.example  (env_var_drift)
   Code reads 1 environment variable that .env.example does not document (SENTRY_AUTH_TOKEN). Fresh clones, CI, and the production deploy can silently run without them.

Verdict: ✅ no blockers, 1 warning · score 90
Fix: viberaven fix · Details: ~/notes-app/.viberaven/agent-tasklist.md

The warning, and the two that look like it

The plugin checks the token first, then the organization, then the project, and stops the upload at the first one that is empty. The messages come from the plugin source (build-plugin-manager.ts). We reproduced the first two; the project message is from the source and was not triggered.

[sentry-vite-plugin] Warning: No auth token provided. Will not upload source maps. Please set the authToken option. You can find information on how to generate a Sentry auth token here: https://docs.sentry.io/api/auth/

[sentry-vite-plugin] Warning: No org provided. Will not upload source maps. Please set the org option to your Sentry organization slug.

(source only) No project provided. Will not upload source maps. Please set the project option to your Sentry project slug.

The token is in my .env file and the warning stays

Sentry's Vite guide says Vite does not load .env files into process.env while it evaluates the config file, so process.env.SENTRY_AUTH_TOKEN is empty locally. We saw it: with the token only in a .env file the plugin still warned that no auth token was provided, and with the same value exported in the shell it moved on to the next check. On Vercel the project's variables are in the build environment, so the same line works there once the variable exists for that environment. The guide also names an .env.sentry-build-plugin file, which it says to keep out of git.

The build passes and the source maps are lost or public

With build.sourcemap set to true and no token, the .map file stayed in dist next to the JavaScript, which is what Sentry warns about: generated source maps may expose your source code. With build.sourcemap set to "hidden" and sourcemaps.filesToDeleteAfterUpload set, the .map file was deleted from dist even though nothing had been uploaded, so that build can never be de-minified. Sentry's Vercel integration sets SENTRY_AUTH_TOKEN, SENTRY_ORG and SENTRY_PROJECT when you link a project, but its docs say to add a bundler plugin yourself for a Vite app. The Next.js version of this problem is the Next.js source maps page.

Checklist

Upload the source maps from the Vercel build, then check

01
Find a Sentry auth token your Vite config reads but .env.example does not list. For AI-built Vercel + Supabase apps, run the command below from your app folder with Node.js 20 or newer. When vite.config reads process.env.SENTRY_AUTH_TOKEN and .env.example does not list it, it reports env_var_drift as a warning, and it cannot see the variables set in your Vercel project, so a token that .env.example lists but Vercel lacks gets no finding. It is a repository check, not a live database test: it does not run vite build or call Sentry.
```
npx -y viberaven@1.7.1 check
```

Find where the plugin gets its token:

grep -rn "SENTRY_AUTH_TOKEN\|sentryVitePlugin" --exclude-dir=node_modules --exclude-dir=dist .

Put the plugin last in the plugins array, generate hidden source maps and delete them after the upload. This is the shape from Sentry's Vite guide, tested here on 11.10.0:

import { defineConfig } from "vite";
import { sentryVitePlugin } from "@sentry/vite-plugin";

export default defineConfig({
  build: { sourcemap: "hidden" },
  plugins: [
    // other plugins first
    sentryVitePlugin({
      org: "<your-org-slug>",
      project: "<your-project-slug>",
      authToken: process.env.SENTRY_AUTH_TOKEN,
      sourcemaps: { filesToDeleteAfterUpload: ["./dist/**/*.map"] },
    }),
  ],
});

04Create an auth token in Sentry and add it in Vercel as SENTRY_AUTH_TOKEN for Production and Preview. Add SENTRY_AUTH_TOKEN= with no value to .env.example, so the name is documented without the token.
05Redeploy, and read the Vercel build log: the "[sentry-vite-plugin] Warning" lines should be gone.
06In Sentry, open Settings > Projects > your project > Source Maps and check that files from the new build are listed. Then trigger a new error: errors captured before the upload stay minified.

Sources

Official docs behind this checklist

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Does the missing token fail the build?

No. In our run vite build printed the warning and exited with code 0, so a deploy goes through with unreadable stack traces. That is why the line in the build log is easy to miss.

Do I need the Vercel integration?

No. It creates the token and sets SENTRY_AUTH_TOKEN, SENTRY_ORG and SENTRY_PROJECT in your Vercel project, but the plugin uploads the same way with a token you add yourself.

Should I leave the .map files in dist?

Sentry's Vite guide says generated source maps may expose your source code. It suggests deleting them after the upload with filesToDeleteAfterUpload, or denying access to .js.map files on your server.