{"record":{"id":"397f04a7e287ca81","repo":"RocketChat/Rocket.Chat","slug":"error-user-registration-secret","errorCode":"error-user-registration-secret","errorMessage":"User registration is only allowed via Secret URL","messagePattern":"User registration is only allowed via Secret URL","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/registerUser.ts","lineNumber":82,"sourceCode":"\t\t\tpass: String,\n\t\t\tname: String,\n\t\t\tsecretURL: Match.Optional(String),\n\t\t\treason: Match.Optional(String),\n\t\t}),\n\t);\n\n\tif (settings.get('Accounts_RegistrationForm') === 'Disabled') {\n\t\tthrow new Meteor.Error('error-user-registration-disabled', 'User registration is disabled', {\n\t\t\tmethod: 'registerUser',\n\t\t});\n\t}\n\n\tif (\n\t\tsettings.get('Accounts_RegistrationForm') === 'Secret URL' &&\n\t\t(!formData.secretURL || formData.secretURL !== settings.get('Accounts_RegistrationForm_SecretURL'))\n\t) {\n\t\tif (!formData.secretURL) {\n\t\t\tthrow new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', {\n\t\t\t\tmethod: 'registerUser',\n\t\t\t});\n\t\t}\n\n\t\ttry {\n\t\t\tawait validateInviteToken(formData.secretURL);\n\t\t} catch (e) {\n\t\t\tthrow new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', {\n\t\t\t\tmethod: 'registerUser',\n\t\t\t});\n\t\t}\n\t}\n\n\tpasswordPolicy.validate(formData.pass);\n\n\tawait validateEmailDomain(formData.email);\n\n\tconst userData = {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/registerUser.ts#L64-L100","documentation":"Thrown by 'registerUser' when Accounts_RegistrationForm is 'Secret URL' and the client sent no secretURL at all. In Secret URL mode the payload must carry formData.secretURL matching the configured Accounts_RegistrationForm_SecretURL, or a valid invite token. The method fails fast on the missing parameter before touching invite validation.","triggerScenarios":"Meteor.callAsync('registerUser', { email, pass, name }) with no secretURL field while Registration Form = 'Secret URL'; a custom signup form that did not forward the token from the invite link; navigating directly to /register instead of the invite URL.","commonSituations":"Custom signup UIs that hardcode the plain form while the workspace admin switched to Secret URL mode; invite links where the hash query param was stripped by a redirect or email client.","solutions":["Include formData.secretURL: either the value of Accounts_RegistrationForm_SecretURL or the token from the invite URL (/invite/:token or /register/:hash).","If users should register without an invite: switch Registration Form to 'Public' in Administration > Accounts.","If you are the admin: copy the exact Secret URL/invite link and distribute that link to users."],"exampleFix":"// before\nawait Meteor.callAsync('registerUser', { email, pass, name });\n\n// after: forward the token from the invite URL the user arrived on\nconst token = FlowRouter.getParam('hash'); // e.g. /register/:hash\nawait Meteor.callAsync('registerUser', { email, pass, name, secretURL: token });","handlingStrategy":"validation","validationCode":"const secretURL = new URLSearchParams(location.search).get('invite')\n  ?? FlowRouter.getParam('hash');\nif (!secretURL) {\n  showError('Registration requires an invitation link.');\n} else {\n  await Meteor.callAsync('registerUser', { ...formData, secretURL });\n}","typeGuard":null,"tryCatchPattern":"try {\n  await Meteor.callAsync('registerUser', { ...formData, secretURL });\n} catch (e) {\n  if ((e as Meteor.Error).error === 'error-user-registration-secret') {\n    showError('Open the invitation link sent to you, then register from that page.');\n  }\n}","preventionTips":["Always propagate the invite token from the entry URL into the registerUser payload","Do not link users to the bare /register route on Secret URL workspaces","Keep a single helper that extracts the token so no call site forgets it"],"tags":["registration","invite-token","accounts","meteor-method"],"backgroundTag":"missing-invite-token","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}