Mintplex-Labs/anything-llm · error

Invalid auth token.

Error message

Invalid auth token.

What it means

Auth guard in validateMultiUserRequest: a bearer token was supplied but decodeJWT returned an invalid payload without a user id, meaning the JWT is malformed, expired, or signed with the wrong secret, so the request is refused with 401.

Source

Thrown at server/utils/middleware/validatedRequest.js:87

  UserMetaCache.setFromRequest(request);
  next();
}

async function validateMultiUserRequest(request, response, next) {
  const auth = request.header("Authorization");
  const token = auth ? auth.split(" ")[1] : null;

  if (!token) {
    response.status(401).json({
      error: "No auth token found.",
    });
    return;
  }

  const valid = decodeJWT(token);
  if (!valid || !valid.id) {
    response.status(401).json({
      error: "Invalid auth token.",
    });
    return;
  }

  const user = await User.get({ id: valid.id });
  if (!user) {
    response.status(401).json({
      error: "Invalid auth for user.",
    });
    return;
  }

  if (user.suspended) {
    response.status(401).json({
      error: "User is suspended from system",
    });
    return;

View on GitHub (pinned to 3aec848f28)

Solutions

1. Log in again to obtain a valid JWT for multi-user mode.
2. Check the token is sent as 'Bearer <token>' and JWT_SECRET matches the one that signed it.

When it happens

Trigger: Invalid auth token presented. Triggered when the bearer token does not match or decode (validatedRequest.js:87).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/731f6a5e313289d7. Report an issue: GitHub.