RocketChat/Rocket.Chat · error

No token

Error message

No token

What it means

Error "No token" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/oauth2-server/oauth.ts:148

				return res.redirect('/oauth/error/invalid_redirect_uri');
			}

			return next();
		});

		this.app.post('/oauth/authorize', debugMiddleware, async (req, res, next) => {
			if (req.body.allow !== 'yes') {
				res.status(401);
				return res.send({ error: 'access_denied', error_description: 'The user denied access to your application' });
			}

			// The new version of the library is expecting a new name. Doing this for compatibility
			if (req.body.token && !req.body.access_token) {
				req.body.access_token = req.body.token;
			}

			if (req.body.access_token == null) {
				return res.status(401).send('No token');
			}

			const user = await Users.findOne(
				{
					'services.resume.loginTokens.hashedToken': Accounts._hashLoginToken(req.body.access_token),
				},
				{ projection: { _id: 1 } },
			);

			if (user == null) {
				return res.status(401).send('Invalid token');
			}

			res.locals.user = { id: user._id };

			return next();
		});

View on GitHub (pinned to b2c16d5842)

Solutions

1. Include a valid access_token (or legacy token) field in the POST body to /oauth/authorize.
2. Ensure the user is logged in and the client forwards their login token with the authorization request.

When it happens

Trigger: Thrown at apps/meteor/server/oauth2-server/oauth.ts:148 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d33689df5c7c0821. Report an issue: GitHub.