{"record":{"id":"3539e8f990b7afa9","repo":"calcom/cal.diy","slug":"nextauthstrategy-authentication-token-is-missing","errorCode":null,"errorMessage":"NextAuthStrategy - Authentication token is missing or invalid.","messagePattern":"NextAuthStrategy - Authentication token is missing or invalid\\.","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"apps/api/v2/src/modules/auth/strategies/next-auth/next-auth.strategy.ts","lineNumber":21,"sourceCode":"import { Injectable, InternalServerErrorException, UnauthorizedException } from \"@nestjs/common\";\nimport { ConfigService } from \"@nestjs/config\";\nimport { PassportStrategy } from \"@nestjs/passport\";\nimport type { Request } from \"express\";\nimport { getToken } from \"next-auth/jwt\";\n\n@Injectable()\nexport class NextAuthStrategy extends PassportStrategy(NextAuthPassportStrategy, \"next-auth\") {\n  constructor(private readonly userRepository: UsersRepository, private readonly config: ConfigService) {\n    super();\n  }\n\n  async authenticate(req: Request) {\n    try {\n      const nextAuthSecret = this.config.get(\"next.authSecret\", { infer: true });\n      const payload = await getToken({ req, secret: nextAuthSecret });\n\n      if (!payload) {\n        throw new UnauthorizedException(\"NextAuthStrategy - Authentication token is missing or invalid.\");\n      }\n\n      if (!payload.email) {\n        throw new UnauthorizedException(\"NextAuthStrategy - Email not found in the authentication token.\");\n      }\n\n      const user = await this.userRepository.findByEmailWithProfile(payload.email);\n      if (!user) {\n        throw new UnauthorizedException(\n          \"NextAuthStrategy - User associated with the authentication token email not found.\"\n        );\n      }\n\n      return this.success(user);\n    } catch (error) {\n      if (error instanceof Error) return this.error(error);\n      return this.error(\n        new InternalServerErrorException(","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/strategies/next-auth/next-auth.strategy.ts#L3-L39","documentation":"Thrown by the NextAuthStrategy Passport strategy (the @nestjs/passport 'next-auth' strategy) when next-auth/jwt getToken() returns null — meaning no decodable session token was found on the request, or the signature did not validate against next.authSecret. This strategy protects routes that authenticate via the NextAuth session cookie.","triggerScenarios":"A request to a route guarded by the 'next-auth' passport strategy with no session cookie, an expired session, a tampered cookie, or a cookie signed with a different next.authSecret than the API uses.","commonSituations":"Calling an API route from outside the browser without forwarding the session cookie; the API's NEXTAUTH_SECRET / next.authSecret differs from the web app's; clock skew causing the JWT to be treated as expired; cookie stripped by a reverse proxy.","solutions":["Forward the full Cookie header (in particular the NextAuth session cookie, default name next-auth.session-token) with the request.","Ensure the `next.authSecret` / NEXTAUTH_SECRET configured on the API matches the web app that issued the cookie.","If calling server-to-server, use the platform OAuth access token or an API key instead of the session cookie.","Make sure the user actually has a logged-in session before the call (hit the sign-in flow first)."],"exampleFix":"// before\nfetch(`${API}/next-auth-protected`, {});\n\n// after\nfetch(`${API}/next-auth-protected`, { credentials: 'include', headers: { Cookie: sessionCookie } });","handlingStrategy":"validation","validationCode":"const cookie = getCookie('next-auth.session-token');\nif (!cookie) throw new Error('No NextAuth session cookie; sign in first or use an API key');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Forward credentials (the full Cookie header) on every call to next-auth-guarded routes.","Keep NEXTAUTH_SECRET identical between the web app and the API v2 instance.","Use platform OAuth access tokens or API keys for non-browser clients."],"tags":["auth","next-auth","session","jwt","platform"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}