RocketChat/Rocket.Chat · warning

authorization failed when sending push to gateway. not retry

Error message

authorization failed when sending push to gateway. not retrying.

What it means

While relaying a mobile push through the Rocket.Chat Push Gateway (the cloud service that forwards to APN/FCM), the gateway answered HTTP 401. The client logs this warning and gives up on that push — 401 means the workspace's gateway credentials are invalid or revoked, so retrying the same request cannot succeed.

Source

Thrown at apps/meteor/server/lib/notifications/push/push.ts:300

			...(token && this.options.getAuthorization && { headers: { Authorization: await this.options.getAuthorization() } }),
		} as ExtendedFetchOptions;

		const result = await fetch(`${gateway}/push/${service}/send`, options);
		const response = await result.text();

		if (result.status === 406) {
			logger.info({ msg: 'removing push token', token });
			this.removeToken(token);
			return;
		}

		if (result.status === 422) {
			logger.info({ msg: 'gateway rejected push notification. not retrying.', response });
			return;
		}

		if (result.status === 401) {
			logger.warn({ msg: 'authorization failed when sending push to gateway. not retrying.', response });
			return;
		}

		if (result.ok) {
			return;
		}

		const { tries, maxRetries } = retryOptions;

		logger.error({ msg: 'Error sending push to gateway', tries, err: response });

		if (tries < maxRetries) {
			// [1, 2, 4, 8, 16] minutes (total 31)
			const ms = 60000 * Math.pow(2, tries);

			logger.log({ msg: 'Retrying push to gateway', tries: tries + 1, in: ms });

			setTimeout(() => this.sendGatewayPush(gateway, service, token, notification, { tries: tries + 1, maxRetries }), ms);

View on GitHub (pinned to b2c16d5842)

Solutions

1. Re-register the workspace with the cloud / connectivity services (Administration > Connectivity) to refresh gateway credentials
2. Check the push Gateway URL setting for typos or a stale self-hosted address
3. Verify server clock sync (NTP) — large drift can break signed authentication to the gateway
4. If self-hosting the gateway, confirm the gateway recognizes this server's token before blaming APN/FCM — the 401 comes from the gateway itself

// Before relying on gateway push, confirm cloud/gateway registration
const registered = await checkConnectivityServiceRegistration();
if (!registered) {
  // re-register workspace or disable gateway push instead of sending doomed requests
  throw new Error('Push gateway credentials invalid/missing — re-register the workspace before enabling push');
}

When it happens

Trigger: POSTing a push to the gateway returns status 401: the gateway token/registration no longer valid — workspace unregistered from cloud, credentials rotated, or the Gateway URL points at a gateway instance that does not know this workspace.

Common situations: Workspace cloud registration expired or was removed; self-hosted gateway with stale/incorrect tokens; mixed environments (server registered against one cloud, pointed at another gateway).

Related errors

• error-authToken-param-not-valid
• error-not-allowed
• error-invalid-user
• Invalid Api parameter provided, it must be a valid IApi obje
• Invalid command parameter provided, must be a string.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/b327953130c2e189. Report an issue: GitHub.