AlistGo/alist · error

SafePassword is incorrect

Error message

SafePassword is incorrect 

What it means

GetSafeAccessToken posts the encrypted safe-box password to XLUSER /password/check (scene=box); an empty Token in the response means the server rejected the password. The driver reports 'SafePassword is incorrect ' (trailing space included in the message) because an empty token is the only signal the check endpoint gives for a wrong password.

Source

Thrown at drivers/thunder_browser/driver.go:663

	}
	return &resp, nil
}

// GetSafeAccessToken 获取 超级保险柜 AccessToken
func (xc *XunLeiBrowserCommon) GetSafeAccessToken(safePassword string) (string, error) {
	var resp TokenResp
	_, err := xc.Request(XLUSER_API_URL+"/password/check", http.MethodPost, func(req *resty.Request) {
		req.SetBody(&base.Json{
			"scene":    "box",
			"password": EncryptPassword(safePassword),
		})
	}, &resp)
	if err != nil {
		return "", err
	}

	if resp.Token == "" {
		return "", errors.New("SafePassword is incorrect ")
	}
	return resp.Token, nil
}

// Login 登录
func (xc *XunLeiBrowserCommon) Login(username, password string) (*TokenResp, error) {
	url := XLUSER_API_URL + "/auth/signin"
	err := xc.RefreshCaptchaTokenInLogin(GetAction(http.MethodPost, url), username)
	if err != nil {
		return nil, err
	}

	var resp TokenResp
	_, err = xc.Common.Request(url, http.MethodPost, func(req *resty.Request) {
		req.SetBody(&SignInRequest{
			CaptchaToken: xc.GetCaptchaToken(),
			ClientID:     xc.ClientID,
			ClientSecret: xc.ClientSecret,

View on GitHub (pinned to 843d9dc814)

Solutions

1. Re-enter the exact safe-box password (the one used in the Xunlei client's 超级保险柜, which is distinct from the login password) in the storage settings
2. Confirm the safe box feature is enabled on the account and the password matches by opening it in the official client
3. Re-save the storage and retry the safe-box listing

if strings.TrimSpace(xc.SafePassword) == "" {
    return errors.New("safe-box password not configured; set it before accessing the safe box")
}
// optionally pre-verify once at Init
tok, err := xc.GetSafeAccessToken(xc.SafePassword)
if err != nil { return fmt.Errorf("safe password check failed: %w", err) }

_, err := xc.GetSafeAccessToken(pwd)
if err != nil && strings.HasPrefix(err.Error(), "SafePassword is incorrect") {
    return errors.New("the configured safe-box password does not match this account — update it in storage settings")
}

When it happens

Trigger: Calling any safe-box (超级保险柜) operation while the SafePassword configured in the storage addition does not match the account's actual safe-box password; the /password/check response returns a body without a usable token.

Common situations: Safe-box password typo in the driver config; Safe-box password changed on the Xunlei account but not updated in alist; Safe box never enabled on the account, yet a password was set in config and safe-box paths requested

Related errors

• share_ids is required
• refresh token is empty
• url is required
• resolutions is required
• resolution is required

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/db36fbd15201e2fb. Report an issue: GitHub.