Mintplex-Labs/anything-llm · error

No auth token found.

Error message

No auth token found.

What it means

Auth guard in the validatedRequest middleware (single-user token path): AUTH_TOKEN is set but the Authorization header carries no token, so there is nothing to compare against the configured token and the request is refused with 401.

Solutions

1. Include the Authorization header with a Bearer token on the request.
2. Log in first to obtain a token, then retry the request with it.

When it happens

Trigger: Request to a protected route carried no auth token. Triggered when the Authorization header is missing (validatedRequest.js:37).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/fd8fcaadbde1aaf2. Report an issue: GitHub.

Appendix: source

Thrown at server/utils/middleware/validatedRequest.js:37

    !process.env.JWT_SECRET
  ) {
    UserMetaCache.setFromRequest(request);
    next();
    return;
  }

  if (!process.env.AUTH_TOKEN) {
    response.status(401).json({
      error: "You need to set an AUTH_TOKEN environment variable.",
    });
    return;
  }

  const auth = request.header("Authorization");
  const token = auth ? auth.split(" ")[1] : null;

  if (!token) {
    response.status(401).json({
      error: "No auth token found.",
    });
    return;
  }

  const bcrypt = require("bcryptjs");
  const { p } = decodeJWT(token);

  if (p === null || !/\w{32}:\w{32}/.test(p)) {
    response.status(401).json({
      error: "Token expired or failed validation.",
    });
    return;
  }

  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent
  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could
  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex

View on GitHub (pinned to 3aec848f28)