RocketChat/Rocket.Chat · error

Invalid token

Error message

Invalid token

What it means

Error "Invalid token" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/oauth2-server/oauth.ts:159

			// The new version of the library is expecting a new name. Doing this for compatibility
			if (req.body.token && !req.body.access_token) {
				req.body.access_token = req.body.token;
			}

			if (req.body.access_token == null) {
				return res.status(401).send('No token');
			}

			const user = await Users.findOne(
				{
					'services.resume.loginTokens.hashedToken': Accounts._hashLoginToken(req.body.access_token),
				},
				{ projection: { _id: 1 } },
			);

			if (user == null) {
				return res.status(401).send('Invalid token');
			}

			res.locals.user = { id: user._id };

			return next();
		});

		this.app.post('/oauth/authorize', debugMiddleware, async (req: Request, res: Response, next: NextFunction) => {
			const request = new OAuthServer.Request(req);
			const response = new OAuthServer.Response(res);

			try {
				await oauth.authorize(request, response, {
					authenticateHandler: {
						async handle() {
							const clientId = request.body.client_id || request.query?.client_id;

							if (!clientId) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Obtain a fresh login token; the supplied access_token does not match any user's resume login token.
2. Ensure the token is sent unhashed; the server hashes it before lookup.
3. Re-authenticate the user if their session has expired.

When it happens

Trigger: Thrown at apps/meteor/server/oauth2-server/oauth.ts:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/085532f40cbd8caa. Report an issue: GitHub.