Mintplex-Labs/anything-llm · error

Invalid auth credentials.

Error message

Invalid auth credentials.

What it means

Credential guard in validatedRequest (single-user mode): the token's decrypted p payload did not match the stored AUTH_TOKEN credentials via bcrypt, so the presented credentials are wrong and the request is refused with 401.

Source

Thrown at server/utils/middleware/validatedRequest.js:64

  if (p === null || !/\w{32}:\w{32}/.test(p)) {
    response.status(401).json({
      error: "Token expired or failed validation.",
    });
    return;
  }

  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent
  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could
  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex
  // in ln:44 will be marked invalid so they can be logged out and forced to log back in and obtain an encrypted token.
  // This kind of methodology only applies to single-user password mode.
  if (
    !bcrypt.compareSync(
      EncryptionMgr.decrypt(p),
      bcrypt.hashSync(process.env.AUTH_TOKEN, 10)
    )
  ) {
    response.status(401).json({
      error: "Invalid auth credentials.",
    });
    return;
  }

  UserMetaCache.setFromRequest(request);
  next();
}

async function validateMultiUserRequest(request, response, next) {
  const auth = request.header("Authorization");
  const token = auth ? auth.split(" ")[1] : null;

  if (!token) {
    response.status(401).json({
      error: "No auth token found.",
    });
    return;

View on GitHub (pinned to 3aec848f28)

Solutions

1. The token does not match AUTH_TOKEN — log in again with the correct password.
2. Verify AUTH_TOKEN on the server was not changed since the token was issued; if it was, all users must re-authenticate.

When it happens

Trigger: Invalid auth credentials supplied. Triggered when credential validation fails during login/token exchange (validatedRequest.js:64).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/31273ffd3e740167. Report an issue: GitHub.