808bits

CKR_TOKEN_NOT_PRESENT

PKCS#11 return value · 0x000000E0 · decimal 224
hex 0x000000E0 decimal 224 name CKR_TOKEN_NOT_PRESENT

Reaching this means half the addressing already worked. The library found the slot you named and there is nothing in it. On a reader that is literal and easy. On an appliance there is no card to be missing, so the same code is reporting something quite different, and confusing the two costs time.

What the token is reporting

The slot exists and contains no token. Nothing about the slot identifier is wrong, which is worth knowing because it rules out a whole family of configuration mistakes.

Likely causes

Ordered by how often they turn out to be the answer. That ordering is a judgement from experience, not a measured frequency.

There is genuinely no token in the reader

The literal reading, and on smartcard readers usually the correct one.

Check it: Enumerate slots asking only for those with a token present. If the list is empty, nothing is inserted anywhere.

On a network HSM, the client cannot see the partition

An appliance presents partitions as slots, so an empty slot means the client is configured for a partition it cannot currently reach. A credential problem on the client link, a partition that was not assigned, or an appliance that has not finished starting all look like this.

Check it: Use the vendor’s client tool to list what the client can see. If the tool shows the partition and your process does not, the difference is environment or configuration rather than the appliance.

The token is present but not initialized

Some libraries treat an uninitialized token as absent rather than reporting it as an unrecognised one, so a brand new device can present as an empty slot.

Check it: Enumerate all slots rather than only those with tokens, and read the slot’s flags. A slot that reports a token present while the library declines to use it is a different problem from an empty one.

Two processes and one exclusive token

Some tokens allow only one application at a time and present as absent to the second one, which makes the failure depend on start order.

Check it: Stop everything else that talks to the token and retry. If it appears, the token is exclusive rather than missing.

Which calls return it

C_OpenSession, C_GetTokenInfo, C_GetMechanismList, C_InitToken

Often confused with

  • CKR_SLOT_ID_INVALID: The slot itself does not exist. That is an addressing problem, and this is not.
  • CKR_DEVICE_REMOVED: Reported when a token you were already using went away, rather than when one was never there.

By library

SoftHSMv2

There is always one empty slot, and after the first token is initialised it is slot 1 rather than slot 0. Opening a session on it returns this code. Since the token that was expected has moved to a serial-derived slot number, this code and CKR_SLOT_ID_INVALID are two faces of the same mistake on SoftHSM, and which one appears depends on how many tokens exist.

OpenSC

OpenSC reports this when the reader answers but has no card in it ([sl ot.c](https://github.com/OpenSC/OpenSC/blob/4fab8b57301f035432191d5829 22d95d7d426802/src/pkcs11/slot.c#L249-L251)), and also when the reader itself has gone, which the translation table maps here with a comment wondering whether it should have been the device-removed code ([misc.c ](https://github.com/OpenSC/OpenSC/blob/4fab8b57301f035432191d582922d9 5d7d426802/src/pkcs11/misc.c#L114)). A USB reader that was unplugged and a card that was pulled therefore arrive as different codes.

Sources

Every description, cause and check on this page is written from scratch. The specification is cited for the constant's name and its number, which are facts, and for nothing else.