Dokploy/dokploy · error · TRPCError

UNAUTHORIZED

UNAUTHORIZED

Error message

You are not allowed to access this vault provider

What it means

The requested vault provider exists, but its organizationId does not match the caller's organization. This is an ownership/tenancy check enforced in application code, surfaced as UNAUTHORIZED.

Source

Thrown at packages/server/src/services/vault-provider.ts:152

	const provider = await db.query.vaultProvider.findFirst({
		where: eq(vaultProvider.vaultProviderId, vaultProviderId),
	});
	if (!provider) {
		throw new TRPCError({
			code: "NOT_FOUND",
			message: "Vault provider not found",
		});
	}
	return provider;
};

export const findVaultProviderInOrganization = async (
	vaultProviderId: string,
	organizationId: string,
) => {
	const provider = await findVaultProviderById(vaultProviderId);
	if (provider.organizationId !== organizationId) {
		throw new TRPCError({
			code: "UNAUTHORIZED",
			message: "You are not allowed to access this vault provider",
		});
	}
	return provider;
};

export const findVaultProvidersByOrganizationId = async (
	organizationId: string,
) => {
	return await db.query.vaultProvider.findMany({
		where: eq(vaultProvider.organizationId, organizationId),
		orderBy: (providers, { asc }) => [asc(providers.name)],
	});
};

export const updateVaultProvider = async (
	vaultProviderId: string,

View on GitHub (pinned to 546686ea35)

Solutions

1. Use provider IDs that belong to the caller's own organization (list them via the org-scoped endpoint)
2. Verify the provider's organizationId in the DB matches the session's organization
3. Audit callers that store provider IDs to make sure they never persist cross-org references

const provider = await db.query.vaultProvider.findFirst({ where: and(eq(vaultProvider.vaultProviderId, id), eq(vaultProvider.organizationId, sessionOrgId)) });
if (!provider) throw new Error('provider not in your organization');

try { await findVaultProviderInOrganization(id, orgId); } catch (e) { if (e instanceof TRPCError && e.code === 'UNAUTHORIZED') { hideProviderFromUI(id); return; } throw e; }

When it happens

Trigger: Calling findVaultProviderInOrganization(providerId, orgId) where the provider belongs to a different organization — e.g. a user pasting another org's provider ID into an API request or a cross-tenant reference in your data.

Common situations: Multi-tenant leakage attempts, using an ID obtained from a different account/workspace, or passing the wrong organizationId from session context.

Related errors

• UNAUTHORIZED
• UNAUTHORIZED
• UNAUTHORIZED
• UNAUTHORIZED
• UNAUTHORIZED

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/95fe2c70ee3beac4. Report an issue: GitHub.