Mintplex-Labs/anything-llm · error · Error

Error resetting password.

Error message

Error resetting password.

What it means

Thrown by resetPassword in the AnythingLLM frontend when POST /api/system/reset-password with { token, newPassword, confirmPassword } fails. It prefers the server's data.message ('Invalid reset token', password-policy complaint) and otherwise uses the generic fallback. Reset tokens are single-use and short-lived.

Source

Thrown at frontend/src/models/system.js:194

          throw new Error(data.message || "Error recovering account.");
        }
        return data;
      })
      .catch((e) => {
        console.error(e);
        return { success: false, error: e.message };
      });
  },
  resetPassword: async function (token, newPassword, confirmPassword) {
    return await fetch(`${API_BASE}/system/reset-password`, {
      method: "POST",
      headers: baseHeaders(),
      body: JSON.stringify({ token, newPassword, confirmPassword }),
    })
      .then(async (res) => {
        const data = await res.json();
        if (!res.ok) {
          throw new Error(data.message || "Error resetting password.");
        }
        return data;
      })
      .catch((e) => {
        console.error(e);
        return { success: false, error: e.message };
      });
  },

  checkDocumentProcessorOnline: async () => {
    return await fetch(`${API_BASE}/system/document-processing-status`, {
      headers: baseHeaders(),
    })
      .then((res) => res.ok)
      .catch(() => false);
  },
  acceptedDocumentTypes: async () => {
    return await fetch(`${API_BASE}/system/accepted-document-types`, {

View on GitHub (pinned to 20f6d3546c)

Solutions

1. Request a fresh reset link and use it immediately.
2. Confirm both password fields match character-for-character.
3. Meet the password policy the server enforces (length/complexity).
4. Copy the full link from the email rather than clicking a wrapped/truncated URL.

Example fix

// before — rely on the server to catch the mismatch
await System.resetPassword(token, newPassword, confirmPassword);

// after — fail fast client-side
if (newPassword !== confirmPassword) {
  showError('Passwords do not match');
  return;
}
await System.resetPassword(token, newPassword, confirmPassword);

// run before System.resetPassword
if (!token) throw new Error('Reset token is missing from the link');
if (newPassword !== confirmPassword) throw new Error('Passwords do not match');
if (newPassword.length < 8) throw new Error('Password must be at least 8 characters');

const { success, error } = await System.resetPassword(token, newPassword, confirmPassword);
if (!success) {
  showResetError(error); // server message e.g. 'Invalid reset token'
  return;
}

When it happens

Trigger: Submitting an expired or already-consumed reset token; newPassword not matching confirmPassword; a password that violates server policy; a token mangled by an email client wrapping the reset link.

Common situations: Clicking an old reset email after requesting a newer one; retrying the same link after a successful reset; password-manager autofill filling the two fields differently; URL line-wrapping truncating the token in webmail clients.

Related errors

• Could not validate login.
• text
• Error downloading model: ${response.statusText}
• No LocalAI Base Path was set.
• No LocalAi token context limit was set.

AI-assisted analysis of Mintplex-Labs/anything-llm@20f6d3546c (2026-08-18). Data as JSON: /api/errors/a1d656cd0d94b92c. Report an issue: GitHub.