RocketChat/Rocket.Chat · error

access_denied

access_denied

Error message

The user denied access to your application

What it means

Error "The user denied access to your application" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/oauth2-server/oauth.ts:138

			}

			const client = await OAuthApps.findOneActiveByClientId(req.query.client_id);
			if (client == null) {
				return res.redirect('/oauth/error/404');
			}

			const redirectUris: string[] = client.redirectUri.split(',');

			if (typeof req.query.redirect_uri === 'string' && !redirectUris.includes(req.query.redirect_uri)) {
				return res.redirect('/oauth/error/invalid_redirect_uri');
			}

			return next();
		});

		this.app.post('/oauth/authorize', debugMiddleware, async (req, res, next) => {
			if (req.body.allow !== 'yes') {
				res.status(401);
				return res.send({ error: 'access_denied', error_description: 'The user denied access to your application' });
			}

			// The new version of the library is expecting a new name. Doing this for compatibility
			if (req.body.token && !req.body.access_token) {
				req.body.access_token = req.body.token;
			}

			if (req.body.access_token == null) {
				return res.status(401).send('No token');
			}

			const user = await Users.findOne(
				{
					'services.resume.loginTokens.hashedToken': Accounts._hashLoginToken(req.body.access_token),
				},
				{ projection: { _id: 1 } },
			);

View on GitHub (pinned to b2c16d5842)

Solutions

1. The resource owner clicked 'deny' on the OAuth authorization page; ask them to approve the authorization request.
2. Review the requested scopes; the user may refuse because the application requests excessive permissions.

When it happens

Trigger: Thrown at apps/meteor/server/oauth2-server/oauth.ts:138 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/3cb5bd1206df3335. Report an issue: GitHub.