{"record":{"id":"43ef6c12191aa6a4","repo":"home-assistant/core","slug":"system-generated-users-can-only-have-system-type-r","errorCode":null,"errorMessage":"System generated users can only have system type refresh tokens","messagePattern":"System generated users can only have system type refresh tokens","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"homeassistant/auth/__init__.py","lineNumber":483,"sourceCode":"        if user.system_generated and client_id is not None:\n            raise ValueError(\n                \"System generated users cannot have refresh tokens connected \"\n                \"to a client.\"\n            )\n\n        if token_type is None:\n            if user.system_generated:\n                token_type = models.TOKEN_TYPE_SYSTEM\n            else:\n                token_type = models.TOKEN_TYPE_NORMAL\n\n        if token_type is models.TOKEN_TYPE_NORMAL:\n            expire_at = time.time() + REFRESH_TOKEN_EXPIRATION\n        else:\n            expire_at = None\n\n        if user.system_generated != (token_type == models.TOKEN_TYPE_SYSTEM):\n            raise ValueError(\n                \"System generated users can only have system type refresh tokens\"\n            )\n\n        if token_type == models.TOKEN_TYPE_NORMAL and client_id is None:\n            raise ValueError(\"Client is required to generate a refresh token.\")\n\n        if (\n            token_type == models.TOKEN_TYPE_LONG_LIVED_ACCESS_TOKEN\n            and client_name is None\n        ):\n            raise ValueError(\"Client_name is required for long-lived access token\")\n\n        if token_type == models.TOKEN_TYPE_LONG_LIVED_ACCESS_TOKEN:\n            for token in user.refresh_tokens.values():\n                if (\n                    token.client_name == client_name\n                    and token.token_type == models.TOKEN_TYPE_LONG_LIVED_ACCESS_TOKEN\n                ):","sourceCodeStart":465,"sourceCodeEnd":501,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/auth/__init__.py#L465-L501","documentation":"Thrown by AuthManager.async_create_refresh_token (homeassistant/auth/__init__.py:483) when the system_generated flag of the user does not match the requested token type: system-generated users must get TOKEN_TYPE_SYSTEM, and only system-generated users may get TOKEN_TYPE_SYSTEM. Normal users requesting system tokens (or system users requesting normal/long-lived tokens without the default resolution) violate this.","triggerScenarios":"Calling async_create_refresh_token(user, token_type=models.TOKEN_TYPE_SYSTEM) for a regular user; passing token_type=models.TOKEN_TYPE_LONG_LIVED_ACCESS_TOKEN for a system-generated user.","commonSituations":"Copy-pasted token code switching from a service account to a human user without dropping token_type; custom long-lived-token tooling applied to system users.","solutions":["For normal users, omit token_type (defaults to TOKEN_TYPE_NORMAL) or use TOKEN_TYPE_LONG_LIVED_ACCESS_TOKEN with a client_name","Never pass TOKEN_TYPE_SYSTEM yourself — it is reserved for system-generated users and defaults correctly when token_type is None"],"exampleFix":"// before\nawait hass.auth.async_create_refresh_token(user, token_type=models.TOKEN_TYPE_SYSTEM)  # user is not system-generated\n\n# after\nawait hass.auth.async_create_refresh_token(user, client_id=client_id)  # token_type omitted","handlingStrategy":"validation","validationCode":"if not user.system_generated:\n    assert token_type is not models.TOKEN_TYPE_SYSTEM\nawait hass.auth.async_create_refresh_token(user, client_id, token_type=token_type)","typeGuard":"def token_type_matches(user, token_type) -> bool:\n    return user.system_generated == (token_type == models.TOKEN_TYPE_SYSTEM)","tryCatchPattern":null,"preventionTips":["Leave token_type as None for normal users and let defaults apply","Never hand-set TOKEN_TYPE_SYSTEM outside the auth manager itself"],"tags":["auth","python","home-assistant","refresh-token","token-type","valueerror"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}