BookStackApp/BookStack · error · UserTokenNotFoundException

Token "' . $token . '" not found"

Error message

Token "' . $token . '" not found"

What it means

UserTokenNotFoundException raised by checkTokenAndGetUserId when getEntryByToken finds no row matching the supplied token string in the token table. Input at fault: an unknown, already-deleted, or mistyped token value.

Source

Thrown at app/Access/UserTokenService.php:46

    public function deleteByUser(User $user): void
    {
        DB::table($this->tokenTable)
            ->where('user_id', '=', $user->id)
            ->delete();
    }

    /**
     * Get the user id from a token, while checking the token exists and has not expired.
     *
     * @throws UserTokenNotFoundException
     * @throws UserTokenExpiredException
     */
    public function checkTokenAndGetUserId(string $token): int
    {
        $entry = $this->getEntryByToken($token);

        if (is_null($entry)) {
            throw new UserTokenNotFoundException('Token "' . $token . '" not found');
        }

        if ($this->entryExpired($entry)) {
            throw new UserTokenExpiredException("Token of id {$entry->id} has expired.", $entry->user_id);
        }

        return $entry->user_id;
    }

    /**
     * Creates a unique token within the email confirmation database.
     */
    protected function generateToken(): string
    {
        $token = Str::random(24);
        while ($this->tokenExists($token)) {
            $token = Str::random(25);
        }

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Ask the user to re-request the invite/password-reset link so a fresh token is generated
2. Confirm the URL's token matches exactly (no truncation or extra whitespace)
3. Check the token table for the record; it may have been deleted by a later token generation

When it happens

Trigger: Thrown at app/Access/UserTokenService.php:46 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/3ac4538c5bce7fa6. Report an issue: GitHub.