QuantumNous/new-api · warning · AuthRotationError

Authentication rotation has no active session

Error message

Authentication rotation has no active session

What it means

Thrown by applyAuthRotation when a structurally valid rotation payload arrives but the Zustand auth store has no user or session object — i.e. the user is effectively logged out (or was logged out concurrently) while a token rotation response came back. Rotation refreshes credentials for an existing session; with no session there is nothing to rotate.

Source

Thrown at web/src/lib/auth-session.ts:167

  bundle: AuthBundle,
  synchronizeTabs = true
): void {
  const previousSID = useAuthStore.getState().auth.session?.sid
  authEpoch += 1
  useAuthStore.getState().auth.setBundle(bundle)
  if (synchronizeTabs && previousSID !== bundle.session.sid) {
    publishAuthSessionEvent('authenticated', bundle.session.sid)
  }
}

export function applyAuthRotation(value: unknown): void {
  if (!isAuthTokenRotation(value)) {
    throw new AuthRotationError('Invalid authentication rotation response')
  }

  const auth = useAuthStore.getState().auth
  if (!auth.user || !auth.session) {
    throw new AuthRotationError('Authentication rotation has no active session')
  }
  if (value.session.sid !== auth.session.sid) {
    throw new AuthRotationError('Authentication rotation session mismatch')
  }

  applyAuthBundle(
    {
      access_token: value.access_token,
      token_type: value.token_type,
      access_expires_at: value.access_expires_at,
      session: value.session,
      user: auth.user,
    },
    false
  )
}

export function clearAuthentication(

View on GitHub (pinned to e2c7aa7b10)

Solutions

1. Treat this error as a benign race when logout is intended: catch it where rotation is applied and drop the payload instead of surfacing an error to the user.
2. Cancel in-flight refreshes on logout (AbortController tied to auth state) so late rotation responses never reach applyAuthRotation.
3. If it fires without any logout, inspect where auth.session is cleared — an over-aggressive 401 interceptor may be resetting the store.

Example fix

// before
applyAuthRotation(rotationPayload)

// after — ignore rotation after logout
try {
  applyAuthRotation(rotationPayload)
} catch (error) {
  if (error instanceof AuthRotationError && !useAuthStore.getState().auth.session) {
    return // user logged out mid-flight; payload is stale
  }
  throw error
}

const auth = useAuthStore.getState().auth
if (!auth.user || !auth.session) {
  // user is logged out; drop the rotation payload instead of applying it
}

try {
  applyAuthRotation(value)
} catch (error) {
  if (error instanceof AuthRotationError && /no active session/i.test(error.message)) {
    return // benign logout race
  }
  throw error
}

When it happens

Trigger: A rotation response is applied after auth.user or auth.session became null: logout in this tab, a cross-tab auth sync event that cleared state, or a stale async rotation resolving after logout.

Common situations: User logs out in another tab (synchronizeTabs broadcast clears the store) while a refresh request was in flight; session cleanup on 401 racing with the rotation response; store reset on boot finishing after a queued rotation callback.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid authentication rotation response
• Authentication rotation session mismatch
• Failed to sign out session
• Failed to load API keys
• Request failed

AI-assisted analysis of QuantumNous/new-api@e2c7aa7b10 (2026-08-15). Data as JSON: /api/errors/e5a338535ddeecbc. Report an issue: GitHub.