AlistGo/alist · error

unauthorized qbittorrent url

Error message

unauthorized qbittorrent url

What it means

Returned by the qBittorrent offline-download client when, after a login attempt, a probe POST to /api/v2/app/version still does not return 200. It means the stored credentials/url combination never reaches an authorized state.

Source

Thrown at pkg/qbittorrent/client.go:64

	}
	return c, nil
}

func (c *client) checkAuthorization() error {
	// check authorization
	if c.authorized() {
		return nil
	}

	// check authorization after logging in
	err := c.login()
	if err != nil {
		return err
	}
	if c.authorized() {
		return nil
	}
	return errors.New("unauthorized qbittorrent url")
}

func (c *client) authorized() bool {
	resp, err := c.post("/api/v2/app/version", nil)
	if err != nil {
		return false
	}
	return resp.StatusCode == 200 // the status code will be 403 if not authorized
}

func (c *client) login() error {
	// prepare HTTP request
	v := url.Values{}
	v.Set("username", c.url.User.Username())
	passwd, _ := c.url.User.Password()
	v.Set("password", passwd)
	resp, err := c.post("/api/v2/auth/login", v)
	if err != nil {

View on GitHub (pinned to 843d9dc814)

Solutions

1. Verify the qBittorrent WebUI URL, username and password in the storage/offline-download config
2. Whitelist the alist server in qBittorrent's WebUI 'bypass authentication for clients on localhost/subnet' or fix the ban (restart qBittorrent or wait out the ban) after too many failed attempts
3. Confirm cookies are being kept between login and probe requests (same http.Client with cookie jar) and that the URL scheme/port is correct

Example fix

# before (config)
url: http://192.168.1.10:8080
username: admin
password: wrongpass

# after
url: http://192.168.1.10:8080
username: admin
password: correctpass
# and in qBittorrent WebUI settings, allow the alist host subnet

err := c.Login()
if err != nil && strings.Contains(err.Error(), "unauthorized qbittorrent url") {
	// fix config, ensure IP not banned, then retry once after re-login
	return fmt.Errorf("qBittorrent auth failed: check url/credentials and WebUI bypass list: %w", err)
}

When it happens

Trigger: Calling client.Login() (or the first operation that triggers it) with a wrong url, invalid username/password, or when qBittorrent's WebUI blocks the host (banned IP after failed attempts or CSRF/Referer restrictions).

Common situations: Wrong username/password in the alist qBittorrent offline-download settings, WebUI bypass list not including the alist server IP, qBittorrent behind a reverse path that strips cookies, or the server banning the client after repeated bad logins.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• failed to login into qBittorrent webui with url: {url}
• failed to add qBittorrent task: {link}
• failed to delete qbittorrent task
• failed to delete qbittorrent tag
• failed to get account ID: %w

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/8a2b060014d663b1. Report an issue: GitHub.