Significant-Gravitas/AutoGPT · error · Error

Authentication failed — please sign in again.

Error message

Authentication failed — please sign in again.

What it means

Thrown by getCopilotAuthHeaders() in the copilot feature when getWebSocketToken() (a server action from @/lib/auth/actions) returns an error or no token. All direct-to-backend copilot fetch/SSE calls build their Authorization header here, so a failed token fetch aborts every copilot network operation with this message. The underlying cause is almost always an expired Supabase session or a failed server-action round trip, not the copilot backend itself.

Source

Thrown at autogpt_platform/frontend/src/app/(platform)/copilot/helpers.ts:35

export const COPILOT_COMPLETION_NOTIFICATION = {
  title: "AutoGPT",
  body: "Task completed",
  icon: "/notification-icon-192.png",
} as const;

/**
 * Returns HTTP headers required for direct backend requests from copilot:
 * - Authorization Bearer token (JWT)
 * - X-Act-As-User-Id impersonation header (if an admin is impersonating a user)
 *
 * Use this for all direct-to-backend fetch/SSE calls so that admin user
 * impersonation works consistently across the entire copilot feature.
 */
export async function getCopilotAuthHeaders(): Promise<Record<string, string>> {
  const { token, error } = await getWebSocketToken();
  if (error || !token) {
    console.warn("[Copilot] Failed to get auth token:", error);
    throw new Error("Authentication failed — please sign in again.");
  }
  return {
    Authorization: `Bearer ${token}`,
    ...getSystemHeaders(),
  };
}

/**
 * Build the document title showing how many sessions are ready.
 * Returns the base title when count is 0.
 */
export function formatNotificationTitle(count: number): string {
  return count > 0
    ? `(${count}) AutoPilot is ready - ${ORIGINAL_TITLE}`
    : ORIGINAL_TITLE;
}

/**

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Sign in again (reload and re-authenticate) — the message is accurate; the session is dead.
2. Check browser network tab for the getWebSocketToken server action call: a non-200 or redirect confirms a Supabase/config issue rather than copilot code.
3. Verify NEXT_PUBLIC_SUPABASE_URL / NEXT_PUBLIC_SUPABASE_ANON_KEY in frontend/.env match the project the user signed into.
4. If it reproduces immediately after login, confirm the Supabase middleware (src/lib/supabase/middleware.ts) is not stripping auth cookies for the copilot route.
5. As a code-level hardening, catch this error at the call site and redirect to sign-in instead of toasting a generic failure.

Example fix

// before
const headers = await getCopilotAuthHeaders(); // throws, copilot fetch dies silently

// after
try {
  const headers = await getCopilotAuthHeaders();
} catch (e) {
  window.location.href = "/login?redirected=copilot";
  return;
}

import { getWebSocketToken } from "@/lib/auth/actions";

async function hasCopilotAuth(): Promise<boolean> {
  const { token, error } = await getWebSocketToken();
  return !error && !!token;
}

function isAuthFailure(err: unknown): boolean {
  return err instanceof Error && err.message.startsWith("Authentication failed");
}

try {
  const headers = await getCopilotAuthHeaders();
  // ...fetch
} catch (error) {
  if (isAuthFailure(error)) {
    window.location.href = "/login"; // session is unrecoverable client-side
    return;
  }
  throw error;
}

When it happens

Trigger: Calling getCopilotAuthHeaders() after the Supabase JWT has expired (long-lived tab), when the user's session cookie is missing (signed out in another tab, cleared storage), when the getWebSocketToken server action fails (network error, 5xx, middleware redirect), or when it returns { token: null } because no authenticated user exists.

Common situations: Leaving a copilot tab open overnight past JWT expiry; running the frontend against a misconfigured Supabase (wrong NEXT_PUBLIC_SUPABASE_URL/keys); a dev server restart that invalidated cookies; user impersonation flows where the admin session expired; ad-blockers or service workers intercepting the server action.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication error — please sign in again.
• Failed to fetch session (status: ${response.status})
• Failed to update email
• Failed to update email
• Failed to download skill (HTTP ${res.status})

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/535e2ba4d4a3f9b6. Report an issue: GitHub.