RocketChat/Rocket.Chat · error · Meteor.Error

error-user-registration-disabled

error-user-registration-disabled

Error message

User registration is disabled

What it means

Thrown by the 'registerUser' Meteor method (shared by POST /api/v1/users.register) when the server setting Accounts_RegistrationForm is set to 'Disabled'. The server rejects every self-registration attempt before validating the payload. This is an intentional workspace policy gate, not a bug: the admin explicitly closed public signup.

Source

Thrown at apps/meteor/server/meteor-methods/users/registerUser.ts:72

		const stampedLoginToken = await Accounts._generateStampedLoginToken();

		await Accounts._insertLoginToken(userId, stampedLoginToken);
		return stampedLoginToken;
	}
	check(
		formData,
		Match.ObjectIncluding({
			email: String,
			pass: String,
			name: String,
			secretURL: Match.Optional(String),
			reason: Match.Optional(String),
		}),
	);

	if (settings.get('Accounts_RegistrationForm') === 'Disabled') {
		throw new Meteor.Error('error-user-registration-disabled', 'User registration is disabled', {
			method: 'registerUser',
		});
	}

	if (
		settings.get('Accounts_RegistrationForm') === 'Secret URL' &&
		(!formData.secretURL || formData.secretURL !== settings.get('Accounts_RegistrationForm_SecretURL'))
	) {
		if (!formData.secretURL) {
			throw new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', {
				method: 'registerUser',
			});
		}

		try {
			await validateInviteToken(formData.secretURL);
		} catch (e) {
			throw new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', {

View on GitHub (pinned to b2c16d5842)

Solutions

  1. If self-registration should work: as admin, set Administration > Accounts > Registration Form to 'Public' or 'Secret URL' and retry.
  2. If registration must stay closed: create users with an admin-authenticated POST /api/v1/users.create (or use the invite flow) instead of registerUser.
  3. Verify you are pointed at the intended workspace (wrong SERVER_URL / reverse proxy often hits a hardened instance).

Example fix

// before: self-registration against a server with registration Disabled
await Meteor.callAsync('registerUser', { email, pass, name }); // throws error-user-registration-disabled

// after: provision via admin REST endpoint
await fetch('/api/v1/users.create', {
  method: 'POST',
  headers: { 'X-Auth-Token': adminToken, 'X-User-Id': adminUid, 'Content-Type': 'application/json' },
  body: JSON.stringify({ email, password: pass, username, name }),
});
Defensive patterns

Strategy: try-catch

Validate before calling

const resp = await fetch('/api/v1/settings.public');
const { settings } = await resp.json();
const regForm = settings.Accounts_RegistrationForm; // 'Public' | 'Secret URL' | 'Disabled'
if (regForm === 'Disabled') {
  hideSelfRegistrationUI();
}

Try / catch

try {
  await Meteor.callAsync('registerUser', formData);
} catch (e) {
  if ((e as Meteor.Error).error === 'error-user-registration-disabled') {
    showNotice('Registration is closed on this server. Ask an admin for an account.');
    return;
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling Meteor.callAsync('registerUser', { email, pass, name }) or POST /api/v1/users.register on a workspace where Administration > Accounts > Registration Form is 'Disabled'. Also triggered by deploy/test scripts or e2e tests that register users against a server whose registration form was disabled after setup.

Common situations: Enterprises that provision users via LDAP/SAML/OAuth and disable public signup; staging servers cloned from hardened production config; CI tests written when registration was open, later failing after an admin flipped the setting.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9c3cae125c3b18cf. Report an issue: GitHub.