Mintplex-Labs/anything-llm · error

You need to set an AUTH_TOKEN environment variable.

Error message

You need to set an AUTH_TOKEN environment variable.

What it means

Config guard in validatedRequest (single-user mode): the request carried a token but AUTH_TOKEN is not configured on the server, so there is no secret to compare against and authentication is refused with 401.

Source

Thrown at server/utils/middleware/validatedRequest.js:27

  const multiUserMode = await SystemSettings.isMultiUserMode();
  response.locals.multiUserMode = multiUserMode;
  if (multiUserMode)
    return await validateMultiUserRequest(request, response, next);

  // When in development passthrough auth token for ease of development.
  // Or if the user simply did not set an Auth token or JWT Secret
  if (
    process.env.NODE_ENV === "development" ||
    !process.env.AUTH_TOKEN ||
    !process.env.JWT_SECRET
  ) {
    UserMetaCache.setFromRequest(request);
    next();
    return;
  }

  if (!process.env.AUTH_TOKEN) {
    response.status(401).json({
      error: "You need to set an AUTH_TOKEN environment variable.",
    });
    return;
  }

  const auth = request.header("Authorization");
  const token = auth ? auth.split(" ")[1] : null;

  if (!token) {
    response.status(401).json({
      error: "No auth token found.",
    });
    return;
  }

  const bcrypt = require("bcryptjs");
  const { p } = decodeJWT(token);

View on GitHub (pinned to 3aec848f28)

Solutions

1. Set the AUTH_TOKEN environment variable (and JWT_SECRET) and restart the server.
2. Alternatively unset auth entirely for development mode.

When it happens

Trigger: Server started in simple single-user auth mode without AUTH_TOKEN set. Triggered when validatedRequest middleware finds no AUTH_TOKEN environment variable (validatedRequest.js:27).

Common situations: See trigger scenarios.

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/99d2450732e4cb0d. Report an issue: GitHub.