Mintplex-Labs/anything-llm · error · Error

Public token is required to validate a temporary auth token.

Error message

Public token is required to validate a temporary auth token.

What it means

Thrown by TemporaryAuthToken.validate when publicToken is falsy (empty string, null, undefined). Reached via the GET /request-token/sso/simple endpoint which reads request.query.token and passes it straight through. Tokens are single-use, time-boxed credentials for passwordless SSO login.

Source

Thrown at server/models/temporaryAuthToken.js:75

    await prisma.temporary_auth_tokens.deleteMany({
      where: { userId: Number(userId) },
    });
    return true;
  },

  /**
   * Validates a temporary auth token and returns the session token
   * to be set in the browser localStorage for authentication.
   * @param {string} publicToken - the token to validate against
   * @returns {Promise<{sessionToken: string|null, token: import("@prisma/client").temporary_auth_tokens & {user: import("@prisma/client").users} | null, error: string | null}>}
   */
  validate: async function (publicToken = "") {
    /** @type {import("@prisma/client").temporary_auth_tokens & {user: import("@prisma/client").users} | undefined | null} **/
    let token;

    try {
      if (!publicToken)
        throw new Error(
          "Public token is required to validate a temporary auth token."
        );
      token = await prisma.temporary_auth_tokens.findUnique({
        where: { token: String(publicToken) },
        include: { user: true },
      });
      if (!token) throw new Error("Invalid token.");
      if (token.expiresAt < new Date()) throw new Error("Token expired.");
      if (token.user.suspended) throw new Error("User account suspended.");

      // Create a new session token for the user valid for 30 days
      const sessionToken = makeJWT(
        { id: token.user.id, username: token.user.username },
        process.env.JWT_EXPIRY
      );

      return { sessionToken, token, error: null };
    } catch (error) {

View on GitHub (pinned to 526360e320)

Solutions

1. Ensure the SSO login URL includes a non-empty 'token' query parameter (e.g. ?token=allm-tat-...).
2. Verify the upstream issuer (TemporaryAuthToken.issue) returned a token before building the link.
3. Check that no redirect or reverse proxy is dropping the query string.

Example fix

// before
const url = `${baseURL}/request-token/sso/simple`;
// after
const { token } = await TemporaryAuthToken.issue(userId);
const url = `${baseURL}/request-token/sso/simple?token=${encodeURIComponent(token)}`;

if (!publicToken || typeof publicToken !== 'string' || !publicToken.trim()) {
  return respondWithError('Missing token');
}

const isNonEmptyToken = (t) => typeof t === 'string' && t.trim().length > 0;

When it happens

Trigger: GET /request-token/sso/simple with no 'token' query parameter, or with an empty one (e.g. /request-token/sso/simple?token=).

Common situations: SSO link is malformed, the token was stripped by a redirect/proxy, or the integration calling the endpoint forgot to append the token.

Related errors

• Invalid token.
• Token expired.
• Type "${type}" is not a valid type to sync.
• Invalid link provided
• Invalid source property provided

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/77dc0bfcc8e036bb. Report an issue: GitHub.