Dokploy/dokploy · error · TRPCError

UNAUTHORIZED

UNAUTHORIZED

Error message

You don't have access to this project

What it means

Thrown by vault-provider endpoints when a non-owner/non-admin user queries a project that is not in their accessedProjects list for the active organization. Dokploy restricts member access to explicitly granted projects; the membership record's accessedProjects array is the source of truth.

Source

Thrown at apps/dokploy/server/api/routers/vault-provider.ts:141

			await testVaultProviderConnection(config!);
			return true;
		}),

	listSecretNames: withPermission("vaultProvider", "read")
		.input(apiListVaultSecretNames)
		.query(async ({ ctx, input }) => {
			const provider = await findVaultProviderInOrganization(
				input.vaultProviderId,
				ctx.session.activeOrganizationId,
			);

			if (ctx.user.role !== "owner" && ctx.user.role !== "admin") {
				const { accessedProjects } = await findMemberByUserId(
					ctx.user.id,
					ctx.session.activeOrganizationId,
				);
				if (!accessedProjects.includes(input.projectId)) {
					throw new TRPCError({
						code: "UNAUTHORIZED",
						message: "You don't have access to this project",
					});
				}
			}

			if (
				!isVaultProviderAssigned(
					provider.assignments,
					input.projectId,
					input.environmentId,
				)
			) {
				throw new TRPCError({
					code: "FORBIDDEN",
					message:
						"This vault provider is not enabled for the given project/environment",
				});

View on GitHub (pinned to 546686ea35)

Solutions

1. Ask an owner/admin to grant the member access to the project (assign permissions)
2. Switch to a project you have access to, or reselect from the projects list
3. Sign out/in or refresh permissions if access was just granted but the session/member cache is stale

const { accessedProjects } = await trpc.member.permissions.query();
if (accessedProjects.includes(projectId)) {
  await trpc.vaultProvider.byId.query({ projectId, ... });
}

const hasProjectAccess = (accessed: string[], projectId: string) => accessed.includes(projectId);

catch (e) { if (e?.data?.code === 'UNAUTHORIZED' && /access to this project/.test(e.message)) requestAccess(); else throw e; }

When it happens

Trigger: Calling a vault-provider mutation/query with input.projectId while ctx.user.role is 'member' and the member record (found via findMemberByUserId) does not include that projectId in accessedProjects.

Common situations: Member granted access to some projects but the UI/URL still references a revoked or never-granted project; permissions changed after the page loaded; deep links to a project the user was never added to.

Related errors

• FORBIDDEN
• UNAUTHORIZED
• UNAUTHORIZED
• UNAUTHORIZED
• FORBIDDEN

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/de50ed1465b34236. Report an issue: GitHub.