diff --git a/dev/tool/src/calendar.ts b/dev/tool/src/calendar.ts
index 775c433e0e..cd190a09d6 100644
--- a/dev/tool/src/calendar.ts
+++ b/dev/tool/src/calendar.ts
@@ -61,7 +61,7 @@ const CALENDAR_INTEGRATION = 'google-calendar'
 
 export async function performCalendarAccountMigrations (db: Db, region: string | null, kvsUrl: string): Promise<void> {
   console.log('Start calendar migrations')
-  const token = generateToken(systemAccountUuid, '' as WorkspaceUuid, { service: 'tool', admin: 'true' })
+  const token = generateToken(systemAccountUuid, undefined, { service: 'tool', admin: 'true' })
   const accountClient = getAccountClient(token)
 
   const allWorkpaces = await accountClient.listWorkspaces(region)
diff --git a/dev/tool/src/github.ts b/dev/tool/src/github.ts
index e96c220f5d..477b5343dd 100644
--- a/dev/tool/src/github.ts
+++ b/dev/tool/src/github.ts
@@ -53,8 +53,8 @@ export async function performGithubAccountMigrations (
   txes: Tx[],
   region: string | null
 ): Promise<void> {
-  const token = generateToken(systemAccountUuid, '' as WorkspaceUuid, { service: 'admin', admin: 'true' })
-  const githubToken = generateToken(systemAccountUuid, '' as WorkspaceUuid, { service: 'github' })
+  const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' })
+  const githubToken = generateToken(systemAccountUuid, undefined, { service: 'github' })
   const accountClient = getAccountClient(token)
 
   const githubAccountClient = getAccountClient(githubToken)
diff --git a/dev/tool/src/gmail.ts b/dev/tool/src/gmail.ts
index ab35f1bb54..655f18a3f2 100644
--- a/dev/tool/src/gmail.ts
+++ b/dev/tool/src/gmail.ts
@@ -68,7 +68,7 @@ const TOKEN_TYPE = 'token'
 
 export async function performGmailAccountMigrations (db: Db, region: string | null, kvsUrl: string): Promise<void> {
   console.log('Start Gmail migrations')
-  const token = generateToken(systemAccountUuid, '' as WorkspaceUuid, { service: 'admin', admin: 'true' })
+  const token = generateToken(systemAccountUuid, undefined, { service: 'admin', admin: 'true' })
   const accountClient = getAccountClient(token)
 
   const allWorkpaces = await accountClient.listWorkspaces(region)
@@ -98,7 +98,7 @@ async function migrateGmailIntegrations (
 ): Promise<void> {
   try {
     console.log('Start Gmail account migrations')
-    const gmailToken = generateToken(systemAccountUuid, '' as WorkspaceUuid, { service: 'gmail' })
+    const gmailToken = generateToken(systemAccountUuid, undefined, { service: 'gmail' })
     const accountClient = getAccountClient(token)
 
     const gmailAccountClient = getAccountClient(gmailToken)
diff --git a/dev/tool/src/index.ts b/dev/tool/src/index.ts
index a938fb4000..5035e262e7 100644
--- a/dev/tool/src/index.ts
+++ b/dev/tool/src/index.ts
@@ -1063,7 +1063,7 @@ export function devTool (
 
       const skipWorkspaces = new Set(cmd.skip.split(',').map((it) => it.trim()))
 
-      const token = generateToken(systemAccountUuid, '' as WorkspaceUuid, {
+      const token = generateToken(systemAccountUuid, undefined, {
         service: 'tool'
       })
       const workspaces = (await getAccountClient(token).listWorkspaces(cmd.region))
@@ -1691,7 +1691,7 @@ export function devTool (
     .description('Enable or disable profiling')
     .option('-o, --output <output>', 'Output file', 'profile.cpuprofile')
     .action(async (endpoint: string, mode: string, opt: { output: string }) => {
-      const token = generateToken(systemAccountUuid, '' as WorkspaceUuid, { admin: 'true' })
+      const token = generateToken(systemAccountUuid, undefined, { admin: 'true' })
       if (mode === 'start') {
         await fetch(`${endpoint}/api/v1/manage?token=${token}&operation=profile-start`, {
           method: 'PUT'
diff --git a/server/token/src/__tests__/token.test.ts b/server/token/src/__tests__/token.test.ts
index 59da35e389..9023315688 100644
--- a/server/token/src/__tests__/token.test.ts
+++ b/server/token/src/__tests__/token.test.ts
@@ -29,13 +29,13 @@ describe('generateToken', () => {
   it('throws TokenError for invalid account uuid', () => {
     expect(() => {
       generateToken('invalid-uuid' as PersonUuid, '' as WorkspaceUuid, {}, 'secret')
-    }).toThrow('Invalid account uuid')
+    }).toThrow('Invalid account uuid: "invalid-uuid"')
   })
 
   it('throws TokenError for invalid workspace uuid', () => {
     expect(() => {
       generateToken('123e4567-e89b-12d3-a456-426614174000' as PersonUuid, 'invalid-uuid' as WorkspaceUuid, {}, 'secret')
-    }).toThrow('Invalid workspace uuid')
+    }).toThrow('Invalid workspace uuid: "invalid-uuid"')
   })
 
   it('generates token without extra and workspace', () => {
diff --git a/server/token/src/token.ts b/server/token/src/token.ts
index f61522aa92..6659acdb75 100644
--- a/server/token/src/token.ts
+++ b/server/token/src/token.ts
@@ -37,10 +37,10 @@ export function generateToken (
   secret?: string
 ): string {
   if (!validate(accountUuid)) {
-    throw new TokenError('Invalid account uuid')
+    throw new TokenError(`Invalid account uuid: "${accountUuid}"`)
   }
   if (workspaceUuid !== undefined && !validate(workspaceUuid)) {
-    throw new TokenError('Invalid workspace uuid')
+    throw new TokenError(`Invalid workspace uuid: "${workspaceUuid}"`)
   }
 
   return encode(