diff --git a/src/applications/auth/storage/PhabricatorAuthChallenge.php b/src/applications/auth/storage/PhabricatorAuthChallenge.php
--- a/src/applications/auth/storage/PhabricatorAuthChallenge.php
+++ b/src/applications/auth/storage/PhabricatorAuthChallenge.php
@@ -57,7 +57,11 @@
     assert_instances_of($challenges, __CLASS__);
 
     $token_list = $request->getStr(self::HTTPKEY);
-    $token_list = explode(' ', $token_list);
+    if (phutil_nonempty_string($token_list)) {
+      $token_list = explode(' ', $token_list);
+    } else {
+      $token_list = [];
+    }
 
     $token_map = array();
     foreach ($token_list as $token_element) {