{"record":{"id":"33090573c093def7","repo":"calcom/cal.diy","slug":"apiauthstrategy-access-token-invalid-access-to-330905","errorCode":null,"errorMessage":"ApiAuthStrategy - access token - Invalid Access Token.. No owner found for this access token.","messagePattern":"ApiAuthStrategy - access token - Invalid Access Token\\.\\. No owner found for this access token\\.","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts","lineNumber":283,"sourceCode":"    }\n\n    const client = await this.tokensRepository.getAccessTokenClient(accessToken);\n    if (!client) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - access token - OAuth client not found given the access token\"\n      );\n    }\n\n    if (origin && !isOriginAllowed(origin, client.redirectUris)) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`\n      );\n    }\n\n    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);\n\n    if (!ownerId) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`\n      );\n    }\n\n    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(ownerId);\n    if (!user) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - access token - User associated with the access token not found.\"\n      );\n    }\n\n    const organizationId = this.usersService.getUserMainOrgId(user) as number;\n    request.organizationId = organizationId;\n\n    return user;\n  }\n\n  async nextAuthStrategy(token: { email?: string | null }, request: ApiAuthGuardRequest) {","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts#L265-L301","documentation":"Thrown by accessTokenStrategy after getAccessTokenOwnerId(accessToken) returns null. The token validated and its client was found, but no user is recorded as the token's owner — an orphaned token. INVALID_ACCESS_TOKEN constant prefixes the message, signalling to the caller that the token should be treated as invalid even though the underlying row exists.","triggerScenarios":"The access-token row exists in the tokens table but its ownerUserId column is null or points at nothing; can happen with a partially-written/migrated token row or a token minted for a client-credentials flow with no user principal.","commonSituations":"Direct database edits that created a token without an owner; a migration that lost the owner linkage; using a client-credentials-style token where a user-scoped token is required.","solutions":["Discard the current token and run the user-consent OAuth flow (the one that ends with a user id on the token) to mint a fresh access token.","Audit the oauth flow table / tokens table for rows where ownerId is null and clean them up.","Make sure your integration requests authorization for a specific user rather than a userless client-credentials grant."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await api.v2.someEndpoint();\n} catch (err) {\n  if (err?.statusCode === 401 && /No owner found for this access token/i.test(err?.message)) {\n    accessToken = await runUserConsentFlow(); // mint a user-scoped token\n    return api.v2.someEndpoint();\n  }\n  throw err;\n}","preventionTips":["Only mint access tokens through the user-consent OAuth flow so every token carries an ownerId.","On user deletion, cascade-revoke that user's access tokens to fail fast.","Audit token rows for null ownerId during data migrations."],"tags":["auth","oauth","access-token","platform","data-integrity"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}