Budibase/budibase · error · HTTPError

Authentication is required to link chat identity

Error message

Authentication is required to link chat identity

What it means

Confirming a chat identity link attaches the link to the currently signed-in Budibase user, so confirmChatLinkSession requires an authenticated request (ctx.isAuthenticated). The session/workspace checks pass first; only after that is auth enforced, returning HTTP 401 if the caller has no valid session.

Source

Thrown at packages/server/src/api/controllers/ai/chatIdentityLinks.ts:267

  ctx: UserCtx<
    { confirmationToken?: string },
    string,
    { instance: string; token: string }
  >
) {
  const token = resolveToken(ctx.params.token)
  const session =
    await sdk.ai.chatIdentityLinks.getChatIdentityLinkSession(token)
  if (!session) {
    throw new HTTPError("Link token is invalid or has expired", 400)
  }
  assertSessionMatchesInstance({
    workspaceId: session.workspaceId,
    instance: ctx.params.instance,
  })

  if (!ctx.isAuthenticated) {
    throw new HTTPError("Authentication is required to link chat identity", 401)
  }

  const currentGlobalUserId = getCurrentGlobalUserId(ctx)
  if (
    !session.confirmationToken ||
    !session.confirmationGlobalUserId ||
    session.confirmationGlobalUserId !== currentGlobalUserId ||
    ctx.request.body?.confirmationToken !== session.confirmationToken
  ) {
    throw new HTTPError("Link confirmation is invalid or has expired", 400)
  }

  const consumedSession =
    await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token)
  if (!consumedSession) {
    throw new HTTPError("Link token is invalid or has expired", 400)
  }
  assertSessionMatchesInstance({

View on GitHub (pinned to a81a902e9a)

Solutions

1. Log in to the Budibase instance in the same browser before opening the confirmation link
2. Re-authenticate if the session expired, then re-open (or re-issue) the confirm link
3. Open the link on the device/browser where the user is signed in
4. If testing via API, send valid session credentials with the request

Example fix

// before
curl -X POST https://example.com/api/chat-links/instance1/tok123/confirm
// after
curl -X POST https://example.com/api/chat-links/instance1/tok123/confirm \
  -H "Cookie: <authenticated-session-cookie>"

// client-side check before opening the confirm URL
if (!document.cookie.includes("budibase")) location.href = "/login?returnTo=" + encodeURIComponent(confirmUrl)

try {
  await api.confirmLink(instance, token)
} catch (e) {
  if (e instanceof HTTPError && e.status === 401) {
    // redirect the user to login, preserving the confirm URL for retry
  }
  throw e
}

When it happens

Trigger: Hitting the confirm link route without being logged into the Budibase web app — e.g. opening the confirmation URL in a browser/profile without an active session cookie, after session expiry, or via an API client that sends no credentials.

Common situations: User clicks the confirmation link on a different device/browser than where they logged in; session cookie expired between handoff and confirm; corporate browsers blocking third-party cookies on the app domain; calling the endpoint with curl without session auth.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• CouchDB password not set
• Access denied to object store bucket.${err}
• userId is required
• Forbidden
• token is required

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/06405c027d396980. Report an issue: GitHub.