Mintplex-Labs/anything-llm · error

Token expired or failed validation.

Error message

Token expired or failed validation.

What it means

Token guard in validatedRequest (single-user mode): the JWT's decoded p claim is null or fails the 32:32 format regex, meaning the token is expired, legacy, or malformed, so the session is rejected with 401 and a re-login is forced.

Source

Thrown at server/utils/middleware/validatedRequest.js:47

    });
    return;
  }

  const auth = request.header("Authorization");
  const token = auth ? auth.split(" ")[1] : null;

  if (!token) {
    response.status(401).json({
      error: "No auth token found.",
    });
    return;
  }

  const bcrypt = require("bcryptjs");
  const { p } = decodeJWT(token);

  if (p === null || !/\w{32}:\w{32}/.test(p)) {
    response.status(401).json({
      error: "Token expired or failed validation.",
    });
    return;
  }

  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent
  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could
  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex
  // in ln:44 will be marked invalid so they can be logged out and forced to log back in and obtain an encrypted token.
  // This kind of methodology only applies to single-user password mode.
  if (
    !bcrypt.compareSync(
      EncryptionMgr.decrypt(p),
      bcrypt.hashSync(process.env.AUTH_TOKEN, 10)
    )
  ) {
    response.status(401).json({
      error: "Invalid auth credentials.",

View on GitHub (pinned to 3aec848f28)

Solutions

1. Log in again to obtain a fresh JWT — the current token is expired or malformed.
2. Ensure the token is passed unmodified as 'Bearer <token>' and JWT_SECRET has not changed.

When it happens

Trigger: Auth token expired or failed JWT validation. Triggered when token verification fails in validatedRequest (validatedRequest.js:47).

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/344f01d491edc5d4. Report an issue: GitHub.