Mintplex-Labs/anything-llm · error · Error

Could not validate login.

Error message

Could not validate login.

What it means

Thrown by System.requestToken on a non-2xx POST to /api/request-token. This is the login endpoint, so notably NO baseHeaders() is sent — the body is the credentials. The .catch() returns {valid:false, message:e.message}, so the thrown string becomes the user-facing login error.

Source

Thrown at frontend/src/models/system.js:143

  },

  checkAuth: async function (currentToken = null) {
    const valid = await fetch(`${API_BASE}/system/check-token`, {
      headers: baseHeaders(currentToken),
    })
      .then((res) => res.ok)
      .catch(() => false);

    window.localStorage.setItem(AUTH_TIMESTAMP, Number(new Date()));
    return valid;
  },
  requestToken: async function (body) {
    return await fetch(`${API_BASE}/request-token`, {
      method: "POST",
      body: JSON.stringify({ ...body }),
    })
      .then((res) => {
        if (!res.ok) throw new Error("Could not validate login.");
        return res.json();
      })
      .then((res) => res)
      .catch((e) => {
        return { valid: false, message: e.message };
      });
  },
  /**
   * Refreshes the user object from the session.
   * @returns {Promise<{success: boolean, user: Object | null, message: string | null}>}
   */
  refreshUser: () => {
    return fetch(`${API_BASE}/system/refresh-user`, {
      headers: baseHeaders(),
    })
      .then((res) => {
        if (!res.ok) throw new Error("Could not refresh user.");
        return res.json();

View on GitHub (pinned to 526360e320)

Solutions

1. Confirm the deployment's auth mode via System.isMultiUserMode() before calling.
2. Verify the body shape matches what /request-token expects (username + password).
3. Read the response body — many login failures include a specific message that gets discarded into a generic Error.
4. Check that the user account exists and is not suspended.

Example fix

// before
const res = await System.requestToken({ username, password });
if (!res.valid) alert(res.message);

// after (surface server message instead of generic 'Could not validate login.')
const r = await fetch(`${API_BASE}/request-token`, { method:"POST", body: JSON.stringify({ username, password }) });
const data = await r.json();
if (!r.ok) alert(data.message || "Login failed");

function validLoginBody(body) {
  return !!body && typeof body.username === "string" && typeof body.password === "string" && body.password.length > 0;
}

/** @param {any} r @returns {r is {valid:boolean}} */
function isLoginResult(r) { return r != null && typeof r.valid === "boolean"; }

// Library returns {valid:false, message} on failure — read the message.
const res = await System.requestToken(body);
if (!isLoginResult(res) || !res.valid) {
  showLoginError(res.message || "Login failed");
}

When it happens

Trigger: Calling requestToken({username,password}) with wrong credentials (403), when multi-user mode is disabled and the route is unavailable, when the body is missing required fields, or when the account is locked.

Common situations: Single-user mode where /request-token is gated differently than multi-user mode; a typo in the username/password; the password was recently changed; brute-force lockout triggered.

Related errors

• Failed to sync Confluence page content. ${reason}
• Failed to sync GitHub file content. ${reason}
• Failed to sync GitLab file content. ${reason}
• Failed to sync Gitea file content. ${reason}
• Failed to fetch document content

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/fe0675962b369148. Report an issue: GitHub.