AlistGo/alist · error

invalid token: %w

Error message

invalid token: %w

What it means

Returned by authenticateToken (server/mcp/auth.go:70) when the presented MCP token is neither the admin static token nor empty, so it is parsed as a JWT by common.ParseToken and that fails. Typical wrapped causes: expired token, signature made by a different JWTSecret, or malformed token text.

Source

Thrown at server/mcp/auth.go:70

	// No token: guest
	if token == "" {
		guest, err := op.GetGuest()
		if err != nil {
			return nil, fmt.Errorf("failed to get guest: %w", err)
		}
		if guest.Disabled {
			return nil, fmt.Errorf("guest user is disabled")
		}
		if err := loadRoles(guest); err != nil {
			return nil, err
		}
		return guest, nil
	}

	// JWT token
	claims, err := common.ParseToken(token)
	if err != nil {
		return nil, fmt.Errorf("invalid token: %w", err)
	}

	user, err := op.GetUserByName(claims.Username)
	if err != nil {
		return nil, fmt.Errorf("user not found: %w", err)
	}

	if claims.PwdTS != user.PwdTS {
		return nil, fmt.Errorf("password has been changed")
	}
	if user.Disabled {
		return nil, fmt.Errorf("user is disabled")
	}

	if err := loadRoles(user); err != nil {
		return nil, err
	}
	return user, nil

View on GitHub (pinned to 843d9dc814)

Solutions

1. Obtain a fresh token via the login endpoint and update the MCP client config
2. If the secret was intentionally rotated, expect all old tokens to fail — reissue them
3. In clustered setups, ensure every replica shares the same JWT secret
4. Inspect the wrapped error to distinguish 'expired' from 'signature is invalid'

if err != nil && strings.Contains(err.Error(), "invalid token") { token = refreshViaLogin(); retryOnce() }

When it happens

Trigger: MCP client sends an expired login token; the server's JWT secret changed (reinstall, new secret env var, multi-replica cluster with divergent secrets); token from a different OpenList instance.

Common situations: Long-running MCP sessions whose token outlives its expiry; servers regenerated after config loss; tokens cached in tooling across environment rebuilds.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• failed to refresh token: sub not match
• not a jwt token because of invalid segments
• failed to decode jwt token
• token is invalidated
• that's not even a token

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/32abe92516f04ac6. Report an issue: GitHub.