Budibase/budibase · error · HTTPError

Authentication is required to link chat identity

Error message

Authentication is required to link chat identity

What it means

Confirming a chat identity link attaches the link to the currently signed-in Budibase user, so confirmChatLinkSession requires an authenticated request (ctx.isAuthenticated). The session/workspace checks pass first; only after that is auth enforced, returning HTTP 401 if the caller has no valid session.

Solutions

1. Log in to the Budibase instance in the same browser before opening the confirmation link
2. Re-authenticate if the session expired, then re-open (or re-issue) the confirm link
3. Open the link on the device/browser where the user is signed in
4. If testing via API, send valid session credentials with the request

Example fix

// before
curl -X POST https://example.com/api/chat-links/instance1/tok123/confirm
// after
curl -X POST https://example.com/api/chat-links/instance1/tok123/confirm \
  -H "Cookie: <authenticated-session-cookie>"

// client-side check before opening the confirm URL
if (!document.cookie.includes("budibase")) location.href = "/login?returnTo=" + encodeURIComponent(confirmUrl)

try {
  await api.confirmLink(instance, token)
} catch (e) {
  if (e instanceof HTTPError && e.status === 401) {
    // redirect the user to login, preserving the confirm URL for retry
  }
  throw e
}

When it happens

Trigger: Hitting the confirm link route without being logged into the Budibase web app — e.g. opening the confirmation URL in a browser/profile without an active session cookie, after session expiry, or via an API client that sends no credentials.

Common situations: User clicks the confirmation link on a different device/browser than where they logged in; session cookie expired between handoff and confirm; corporate browsers blocking third-party cookies on the app domain; calling the endpoint with curl without session auth.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied to object store bucket.
• Authentication failed with Microsoft Graph. Verify…
• Cannot enforce SSO without an activated configuration
• Cannot reset password.
• CouchDB password not set

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/06405c027d396980. Report an issue: GitHub.

Appendix: source

Thrown at packages/server/src/api/controllers/ai/chatIdentityLinks.ts:267

  ctx: UserCtx<
    { confirmationToken?: string },
    string,
    { instance: string; token: string }
  >
) {
  const token = resolveToken(ctx.params.token)
  const session =
    await sdk.ai.chatIdentityLinks.getChatIdentityLinkSession(token)
  if (!session) {
    throw new HTTPError("Link token is invalid or has expired", 400)
  }
  assertSessionMatchesInstance({
    workspaceId: session.workspaceId,
    instance: ctx.params.instance,
  })

  if (!ctx.isAuthenticated) {
    throw new HTTPError("Authentication is required to link chat identity", 401)
  }

  const currentGlobalUserId = getCurrentGlobalUserId(ctx)
  if (
    !session.confirmationToken ||
    !session.confirmationGlobalUserId ||
    session.confirmationGlobalUserId !== currentGlobalUserId ||
    ctx.request.body?.confirmationToken !== session.confirmationToken
  ) {
    throw new HTTPError("Link confirmation is invalid or has expired", 400)
  }

  const consumedSession =
    await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token)
  if (!consumedSession) {
    throw new HTTPError("Link token is invalid or has expired", 400)
  }
  assertSessionMatchesInstance({

View on GitHub (pinned to a81a902e9a)