RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-token

error-invalid-token

Error message

The invite token is invalid.

What it means

Thrown by validateInviteToken (apps/meteor/server/lib/rooms/invites/validateInviteToken.ts:8) as the very first guard: the token argument is falsy or not a string, so no database lookup has even happened. It uses code 'error-invalid-token' with details { method: 'validateInviteToken', field: 'token' }. This is a caller-side bug (missing/mistyped argument), not a stale invite.

Source

Thrown at apps/meteor/server/lib/rooms/invites/validateInviteToken.ts:8

import { Invites, Rooms } from '@rocket.chat/models';
import { Meteor } from 'meteor/meteor';

import { settings } from '../../../settings';

export const validateInviteToken = async (token: string) => {
	if (!token || typeof token !== 'string') {
		throw new Meteor.Error('error-invalid-token', 'The invite token is invalid.', {
			method: 'validateInviteToken',
			field: 'token',
		});
	}

	const inviteData = await Invites.findOneById(token);
	if (!inviteData) {
		throw new Meteor.Error('error-invalid-token', 'The invite token is invalid.', {
			method: 'validateInviteToken',
			field: 'token',
		});
	}

	const room = await Rooms.findOneById(inviteData.rid);
	if (!room) {
		throw new Meteor.Error('error-invalid-room', 'The invite token is invalid.', {
			method: 'validateInviteToken',
			field: 'rid',

View on GitHub (pinned to b2c16d5842)

Solutions

1. Pass the invite's _id exactly as stored in the Invites collection (e.g. the token segment of an /invite/<token> link)
2. Guard at the call site: only call when typeof token === 'string' && token.trim().length > 0
3. If the token comes from a URL, decodeURIComponent and trim it before calling
4. Inspect error.details.field === 'token' to distinguish this argument bug from a not-found invite

Example fix

// before
const { inviteData, room } = await validateInviteToken(token);

// after
if (typeof token !== 'string' || token.trim().length === 0) {
	throw new Meteor.Error('error-invalid-token', 'The invite token is invalid.', { method: 'validateInviteToken', field: 'token' });
}
const { inviteData, room } = await validateInviteToken(token);

const token = typeof input?.token === 'string' ? input.token.trim() : '';
if (token.length === 0) {
	throw new Error('Invite token missing — provide the token segment of the invite link');
}
const { inviteData, room } = await validateInviteToken(token);

const isNonEmptyString = (v: unknown): v is string => typeof v === 'string' && v.trim().length > 0;

When it happens

Trigger: Calling validateInviteToken(''), validateInviteToken(undefined as any), or with a number/object; e.g. passing a URL query param that was never read, or passing the whole invite document instead of its _id string.

Common situations: Invite hash extracted from a URL path/query arrives undefined after a refactor; form field for the token was left empty; token variable shadowed or renamed during migration from callback to async code.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error-invite-expired
• error-invalid-token
• error-invalid-command-preview
• error-invalid-payload
• Invalid command parameter provided, must be a string.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/29599cebee7e5aa7. Report an issue: GitHub.