Dokploy/dokploy · error · TRPCError

FORBIDDEN

FORBIDDEN

Error message

This vault provider is not enabled for the given project/environment

What it means

Thrown by vault-provider endpoints when the provider exists but isVaultProviderAssigned(provider.assignments, input.projectId, input.environmentId) returns false — the provider has no assignment covering that exact project/environment combination. Vault providers must be explicitly enabled per project and environment.

Source

Thrown at apps/dokploy/server/api/routers/vault-provider.ts:155

					ctx.user.id,
					ctx.session.activeOrganizationId,
				);
				if (!accessedProjects.includes(input.projectId)) {
					throw new TRPCError({
						code: "UNAUTHORIZED",
						message: "You don't have access to this project",
					});
				}
			}

			if (
				!isVaultProviderAssigned(
					provider.assignments,
					input.projectId,
					input.environmentId,
				)
			) {
				throw new TRPCError({
					code: "FORBIDDEN",
					message:
						"This vault provider is not enabled for the given project/environment",
				});
			}

			return await listVaultProviderSecretNames(provider.config);
		}),
});

View on GitHub (pinned to 546686ea35)

Solutions

Open the vault provider settings and add an assignment for the exact project + environment
Verify both input.projectId and input.environmentId match the assignment values exactly
Reload provider assignments if they were just changed

Defensive patterns

Strategy: validation

Validate before calling

const assigned = provider.assignments.some(
  (a) => a.projectId === projectId && a.environmentId === environmentId,
);
if (assigned) await runVaultOperation(); else promptEnableProvider();

Type guard

const isAssigned = (assignments: Assignment[], projectId: string, environmentId: string) =>
  assignments.some((a) => a.projectId === projectId && a.environmentId === environmentId);

Try / catch

catch (e) { if (e?.data?.code === 'FORBIDDEN' && /not enabled/.test(e.message)) openProviderAssignments(); else throw e; }

Prevention

Always send both projectId and environmentId explicitly
After creating a new environment, add vault provider assignments for it
Reload assignments when the provider settings modal opens

When it happens

Trigger: Calling a vault-provider operation with a projectId/environmentId pair that is not in the provider's assignments — e.g. testing a provider for a newly created environment before enabling it there, or using the provider in a different project than assigned.

Common situations: Provider assigned to production environment but the request targets a preview/staging environmentId; assignments edited after the page loaded; environment id omitted so it doesn't match the assignment record.

Related errors

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/91187d022bdacb7b. Report an issue: GitHub.