Dokploy/dokploy · warning

Unauthorized

Error message

Unauthorized

What it means

The catch-all tRPC handler for /api/trpc validates the request with validateRequest (Lucia session); if there is no user or session it responds 401 {message:'Unauthorized'} before mounting the tRPC open-api handler. This is an auth gate, not a tRPC error.

Source

Thrown at apps/dokploy/pages/api/[...trpc].ts:11

import { validateRequest } from "@dokploy/server";
import { createOpenApiNextHandler } from "@dokploy/trpc-openapi";
import type { NextApiRequest, NextApiResponse } from "next";
import { appRouter } from "@/server/api/root";
import { createTRPCContext } from "@/server/api/trpc";

const handler = async (req: NextApiRequest, res: NextApiResponse) => {
	const { session, user } = await validateRequest(req);

	if (!user || !session) {
		res.status(401).json({ message: "Unauthorized" });
		return;
	}

	// @ts-ignore
	return createOpenApiNextHandler({
		router: appRouter,
		createContext: createTRPCContext,
		onError:
			process.env.NODE_ENV === "development"
				? ({ path, error }: { path: string | undefined; error: Error }) => {
						console.error(
							`❌ OpenAPI failed on ${path ?? "<no-path>"}: ${error.message}`,
						);
					}
				: undefined,
	})(req, res);
};

View on GitHub (pinned to 546686ea35)

Solutions

1. Log in again to obtain a fresh session cookie
2. For programmatic clients, authenticate first and forward the session cookie (credentials: 'include' for cross-origin)
3. Check the proxy forwards the Cookie header
4. If sessions constantly expire early, verify server clock and session secret stability

const { session, user } = await validateRequest(req);
if (!user || !session) return res.status(401).json({ message: 'Unauthorized' });

const r = await fetch('/api/trpc/...', { credentials: 'include' });
if (r.status === 401) { window.location.href = '/login'; }

When it happens

Trigger: API call without a valid session cookie; expired session; cookie not sent (cross-origin fetch without credentials); user deleted/deactivated between issue and request.

Common situations: Session expired while the dashboard sat open; curl/Postman call missing the auth cookie; reverse proxy stripping cookies; clock skew invalidating the session.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• BAD_REQUEST
• UNAUTHORIZED
• UNAUTHORIZED
• UNAUTHORIZED
• INNGEST_BASE_URL is required to list deployment jobs

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/75722b62b0024b02. Report an issue: GitHub.