RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

After exchanging the OAuth code for tokens, finishOAuthAuthorization needs the logged-in user (Meteor.userId()) to attach the cloud service credentials to that user's document. If the method call arrives without an authenticated user, it throws error-invalid-user with method 'cloud:finishOAuthAuthorization'.

Source

Thrown at apps/meteor/server/lib/cloud/finishOAuthAuthorization.ts:63

		}

		payload = await response.json();
	} catch (err) {
		SystemLogger.error({
			msg: 'Failed to finish OAuth authorization with Rocket.Chat Cloud',
			url: '/api/oauth/token',
			err,
		});

		return false;
	}

	const expiresAt = new Date();
	expiresAt.setSeconds(expiresAt.getSeconds() + payload.expires_in);

	const uid = Meteor.userId();
	if (!uid) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'cloud:finishOAuthAuthorization',
		});
	}

	await Users.updateOne(
		{ _id: uid },
		{
			$set: {
				'services.cloud': {
					accessToken: payload.access_token,
					expiresAt,
					scope: payload.scope,
					tokenType: payload.token_type,
					refreshToken: payload.refresh_token,
				},
			},
		},
	);

View on GitHub (pinned to b2c16d5842)

Solutions

1. Log back into Rocket.Chat and restart the cloud registration flow from the beginning.
2. Complete the cloud consent step promptly after the redirect to avoid session expiry.
3. Review Accounts session lifetime settings if this recurs for many users.

// before finishing the OAuth leg, make sure the session is still alive
if (!Meteor.userId()) {
  throw new Error('session expired during cloud OAuth — log in again and restart the flow');
}
await Meteor.callAsync('cloud:finishOAuthAuthorization', code, state);

const isSessionAlive = (): boolean => Meteor.userId() != null;

try {
  await Meteor.callAsync('cloud:finishOAuthAuthorization', code, state);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-invalid-user' && e.details?.method === 'cloud:finishOAuthAuthorization') {
    // session dropped mid-flow: re-login and restart the cloud registration
  }
  throw e;
}

When it happens

Trigger: The admin's Rocket.Chat session expired — or they logged out in another tab — while sitting on the cloud consent screen, so the finishing DDP call carries no userId.

Common situations: Long delays on the cloud OAuth consent page; server restart forcing re-login; account login lifetime settings too short; multiple logins invalidating the session.

Related errors

• error-invalid-state
• 401
• Failed to connect to Rocket.Chat Cloud: ${error}
• Failed to connect to Rocket.Chat Cloud: ${response.statusTex
• Invalid registration token

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/1f0810d572eabff1. Report an issue: GitHub.