RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

The deleteOAuthApp Meteor method wrapper throws 'error-invalid-user' when this.userId is falsy — the DDP connection is not authenticated. The method is deprecated since 9.0.0 in favor of DELETE /api/v1/oauth-apps.delete, which takes explicit authentication.

Source

Thrown at apps/meteor/server/meteor-methods/auth/deleteOAuthApp.ts:38

	const application = await OAuthApps.findOneAndDeleteById(applicationId, { projection: { clientId: 1 } });
	if (!application) {
		throw new Meteor.Error('error-application-not-found', 'Application not found', {
			method: 'deleteOAuthApp',
		});
	}

	await OAuthAccessTokens.deleteMany({ clientId: application.clientId });
	await OAuthAuthCodes.deleteMany({ clientId: application.clientId });

	return true;
};

Meteor.methods<ServerMethods>({
	async deleteOAuthApp(applicationId) {
		methodDeprecationLogger.method('deleteOAuthApp', '9.0.0', '/v1/oauth-apps.delete');
		if (!this.userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'deleteOAuthApp' });
		}

		return deleteOAuthApp(this.userId, applicationId);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Log in before calling the method
  2. Migrate to DELETE /api/v1/oauth-apps.delete with an authenticated token
  3. For scripts, authenticate first (POST /api/v1/login or a personal access token)
Defensive patterns

Strategy: validation

Validate before calling

if (!Meteor.userId()) {
  // re-login before deleting OAuth apps
}
await Meteor.callAsync('deleteOAuthApp', applicationId);

Try / catch

try {
  await Meteor.callAsync('deleteOAuthApp', applicationId);
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-invalid-user') {
    // session expired: re-login, then retry once
  }
}

Prevention

When it happens

Trigger: Calling Meteor.call('deleteOAuthApp', applicationId) on a logged-out connection or with an expired resume token.

Common situations: Session expired while the OAuth apps admin page sat open; scripts calling the method without login.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/0643586b3dfcd09b. Report an issue: GitHub.