{"record":{"id":"085532f40cbd8caa","repo":"RocketChat/Rocket.Chat","slug":"invalid-token-085532","errorCode":null,"errorMessage":"Invalid token","messagePattern":"Invalid token","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"apps/meteor/server/oauth2-server/oauth.ts","lineNumber":159,"sourceCode":"\n\t\t\t// The new version of the library is expecting a new name. Doing this for compatibility\n\t\t\tif (req.body.token && !req.body.access_token) {\n\t\t\t\treq.body.access_token = req.body.token;\n\t\t\t}\n\n\t\t\tif (req.body.access_token == null) {\n\t\t\t\treturn res.status(401).send('No token');\n\t\t\t}\n\n\t\t\tconst user = await Users.findOne(\n\t\t\t\t{\n\t\t\t\t\t'services.resume.loginTokens.hashedToken': Accounts._hashLoginToken(req.body.access_token),\n\t\t\t\t},\n\t\t\t\t{ projection: { _id: 1 } },\n\t\t\t);\n\n\t\t\tif (user == null) {\n\t\t\t\treturn res.status(401).send('Invalid token');\n\t\t\t}\n\n\t\t\tres.locals.user = { id: user._id };\n\n\t\t\treturn next();\n\t\t});\n\n\t\tthis.app.post('/oauth/authorize', debugMiddleware, async (req: Request, res: Response, next: NextFunction) => {\n\t\t\tconst request = new OAuthServer.Request(req);\n\t\t\tconst response = new OAuthServer.Response(res);\n\n\t\t\ttry {\n\t\t\t\tawait oauth.authorize(request, response, {\n\t\t\t\t\tauthenticateHandler: {\n\t\t\t\t\t\tasync handle() {\n\t\t\t\t\t\t\tconst clientId = request.body.client_id || request.query?.client_id;\n\n\t\t\t\t\t\t\tif (!clientId) {","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/oauth2-server/oauth.ts#L141-L177","documentation":"Error \"Invalid token\" thrown in RocketChat/Rocket.Chat.","triggerScenarios":"Thrown at apps/meteor/server/oauth2-server/oauth.ts:159 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Obtain a fresh login token; the supplied access_token does not match any user's resume login token.","Ensure the token is sent unhashed; the server hashes it before lookup.","Re-authenticate the user if their session has expired."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}