{"record":{"id":"4f3cd0b2dc78ecd2","repo":"instructure/canvas-lms","slug":"cannot-use-initial-token-account-does-not-have-ai","errorCode":null,"errorMessage":"Cannot use initial token: account does not have ai_experiences_v2_auth enabled","messagePattern":"Cannot use initial token: account does not have ai_experiences_v2_auth enabled","errorType":"validation","errorClass":"LlmConversation::Errors::ConversationError","httpStatus":null,"severity":"error","filePath":"lib/llm_conversation/http_client.rb","lineNumber":33,"sourceCode":"# details.\n#\n# You should have received a copy of the GNU Affero General Public License along\n# with this program. If not, see <http://www.gnu.org/licenses/>.\n#\n\nrequire \"net/http\"\nrequire \"json\"\nrequire \"uri\"\n\nmodule LlmConversation\n  class HttpClient\n    def initialize(account: nil, use_initial_token: false)\n      @base_url = resolve_base_url\n      @account = account\n      @v2_auth = account&.feature_enabled?(:ai_experiences_v2_auth)\n\n      if use_initial_token && @account.present? && !@v2_auth\n        raise LlmConversation::Errors::ConversationError,\n              \"Cannot use initial token: account does not have ai_experiences_v2_auth enabled\"\n      end\n\n      @bearer_token = if use_initial_token\n                        Rails.application.credentials.dig(:llm_conversation_service, :initial_token)\n                      elsif @v2_auth\n                        LlmConversation::TokenCache.get_api_token(@account)\n                      else\n                        Rails.application.credentials.llm_conversation_bearer_token\n                      end\n    end\n\n    def get(path)\n      request(:get, path)\n    end\n\n    def post(path, payload: nil)\n      request(:post, path, payload:)","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/lib/llm_conversation/http_client.rb#L15-L51","documentation":"LlmConversation::HttpClient's constructor guards use_initial_token: the initial token from Rails credentials is only permitted for accounts that have the ai_experiences_v2_auth feature flag enabled. If you pass use_initial_token: true with a non-nil account lacking that flag, it raises LlmConversation::Errors::ConversationError immediately at initialization.","triggerScenarios":"Calling LlmConversation::HttpClient.new(account: some_account, use_initial_token: true) where some_account.feature_enabled?(:ai_experiences_v2_auth) is false.","commonSituations":"The feature flag was never turned on (or was turned off) for the account; code written for flag-less accounts was switched to use_initial_token after an account was attached; staging/test accounts differ from production flag state; passing a real account where previously nil was passed.","solutions":["Enable the ai_experiences_v2_auth feature flag on the account (rails c: account.enable_feature!(:ai_experiences_v2_auth)) or via the account feature settings UI.","Drop use_initial_token: true if the account is meant to use legacy bearer-token auth (credentials.llm_conversation_bearer_token).","Pass account: nil with use_initial_token: true only when you truly want the account-less initial-token path (the guard only fires for a present account).","Align the calling code's auth-mode choice with the account's feature flag state before constructing the client."],"exampleFix":"# before\nclient = LlmConversation::HttpClient.new(account: account, use_initial_token: true)\n\n# after\nif account.feature_enabled?(:ai_experiences_v2_auth)\n  client = LlmConversation::HttpClient.new(account: account, use_initial_token: true)\nelse\n  client = LlmConversation::HttpClient.new(account: account)\nend","handlingStrategy":"validation","validationCode":"raise 'v2 flag required' if account && !account.feature_enabled?(:ai_experiences_v2_auth) && use_initial_token\nclient = LlmConversation::HttpClient.new(account: account, use_initial_token: use_initial_token)","typeGuard":"def initial_token_allowed?(account)\n  account.nil? || account.feature_enabled?(:ai_experiences_v2_auth)\nend","tryCatchPattern":"begin\n  client = LlmConversation::HttpClient.new(account: account, use_initial_token: true)\nrescue LlmConversation::Errors::ConversationError => e\n  Rails.logger.warn(\"initial token unavailable: #{e.message}\")\n  client = LlmConversation::HttpClient.new(account: account)\nend","preventionTips":["Check account.feature_enabled?(:ai_experiences_v2_auth) before choosing the initial-token mode","Keep flag state consistent across environments used by the same code path","Centralize client construction in a factory that picks the auth mode"],"tags":["ruby","feature-flag","auth","http-client"],"backgroundTag":"feature-not-enabled","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}