RocketChat/Rocket.Chat · error · Meteor.Error

invalid-token

invalid-token

Error message

invalid-token

What it means

Thrown as Meteor.Error('invalid-token') in GET livechat/visitor/:token when VisitorsRaw.getVisitorByToken returns null. The route has no auth/permission gate, so the token is the sole lookup key; a miss means no visitor in the collection has that token.

Source

Thrown at apps/meteor/server/api/v1/omnichannel/visitor.ts:112

			if (!result) {
				return API.v1.success({ visitor });
			}

			return API.v1.success({ visitor: await VisitorsRaw.findOneEnabledById(visitor._id) });
		},
	},
);

API.v1.addRoute('livechat/visitor/:token', {
	async get() {
		check(this.urlParams, {
			token: String,
		});

		const visitor = await VisitorsRaw.getVisitorByToken(this.urlParams.token, {});

		if (!visitor) {
			throw new Meteor.Error('invalid-token');
		}

		return API.v1.success({ visitor });
	},
	async delete() {
		check(this.urlParams, {
			token: String,
		});

		const visitor = await VisitorsRaw.getVisitorByToken(this.urlParams.token, {});
		if (!visitor) {
			throw new Meteor.Error('invalid-token');
		}
		const extraQuery = await callbacks.run('livechat.applyRoomRestrictions', {}, { userId: this.userId });
		const rooms = await LivechatRooms.findOpenByVisitorToken(
			this.urlParams.token,
			{
				projection: {

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Ensure POST livechat/visitor completed successfully before querying by token.
  2. Re-register the visitor to obtain a fresh token if the original was deleted.
  3. Trim and verify the token length before issuing the GET.

Example fix

null
Defensive patterns

Strategy: validation

Validate before calling

if (!token?.trim()) throw new Error('token required');
await fetch(`/api/v1/v1/livechat/visitor/${encodeURIComponent(token)}`);

Type guard

function isNonEmptyToken(t: unknown): t is string {
  return typeof t === 'string' && t.trim().length > 0;
}

Try / catch

try { await fetch(url); } catch (e) { if (e.error === 'invalid-token') { /* re-register visitor, then retry */ } }

Prevention

When it happens

Trigger: GET /api/v1/v1/livechat/visitor/<token> with a token that was never registered, was deleted, or was mistyped in the URL.

Common situations: Widget stored a token that was never persisted (registration failed silently); visitor was deleted via GDPR or admin tooling; URL copy/paste truncated the token.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/64e0f6b2ca67ddbc. Report an issue: GitHub.