RocketChat/Rocket.Chat · error · Meteor.Error

invalid-user

invalid-user

Error message

Invalid User

What it means

Thrown by the Meteor.methods wrapper of addIncomingIntegration when this.userId is falsy: the DDP method was invoked without an authenticated user. This checks the CALLER's session, unrelated to integration.username. Typical causes are expired/invalid login tokens, calling before login finished, or server-side Meteor.call which carries no user context.

Source

Thrown at apps/meteor/server/meteor-methods/integrations/incoming/addIncomingIntegration.ts:190

	const { insertedId } = await Integrations.insertOne(strippedIntegrationData);

	const integrationStored = await Integrations.findOne({ _id: insertedId });

	if (!integrationStored) {
		throw new Error('Error inserting integration');
	}
	void notifyOnIntegrationChanged({ ...integrationStored, _id: insertedId }, 'inserted');

	return integrationStored as IIncomingIntegration;
};

Meteor.methods<ServerMethods>({
	async addIncomingIntegration(integration: INewIncomingIntegration): Promise<IIncomingIntegration> {
		methodDeprecationLogger.method('addIncomingIntegration', '9.0.0', '/v1/integrations.create');
		const { userId } = this;

		if (!userId) {
			throw new Meteor.Error('invalid-user', 'Invalid User', {
				method: 'addIncomingIntegration',
			});
		}

		return addIncomingIntegration(userId, integration);
	},
});

View on GitHub (pinned to b2c16d5842)

Solutions

1. Ensure the user is logged in before the call: await the login promise and check Meteor.userId()
2. For server-to-server or scripted usage, switch to the REST API POST /api/v1/integrations.create with X-Auth-Token/X-User-Id headers
3. If the token expired, re-authenticate (logout/login or token refresh) and retry

Example fix

// before: server-side or pre-login call
Meteor.call('addIncomingIntegration', integration); // this.userId is undefined -> 'invalid-user'
// after: authenticated REST call
await fetch(`${root}/api/v1/integrations.create`, { method: 'POST', headers: { 'X-Auth-Token': token, 'X-User-Id': userId, 'Content-Type': 'application/json' }, body: JSON.stringify(integration) });

if (!Meteor.userId()) throw new Error('login required before creating integrations');
await Meteor.callAsync('addIncomingIntegration', integration);

try {
  await Meteor.callAsync('addIncomingIntegration', integration);
} catch (err) {
  if (err instanceof Meteor.Error && err.error === 'invalid-user') { /* redirect to login, preserve form state */ }
}

When it happens

Trigger: Client invokes the method after the token expired or the user logged out; a call raced ahead of Meteor.loginWithPassword completing; server code running Meteor.call('addIncomingIntegration', ...) directly (no bound user).

Common situations: Long-lived dashboards whose session expired overnight; hot-reload losing the accounts state in development; importers/migration scripts using DDP instead of the REST API.

Related errors

• error-invalid-channel
• error-invalid-channel-start-with-chars
• error-invalid-username
• error-invalid-user
• error-user-lacks-message-impersonate-permission

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/f060b811532ad0ce. Report an issue: GitHub.