{"record":{"id":"5eecac8616f6e523","repo":"home-assistant/core","slug":"user-is-not-active","errorCode":null,"errorMessage":"User is not active","messagePattern":"User is not active","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"homeassistant/auth/__init__.py","lineNumber":463,"sourceCode":"        modules: dict[str, str] = OrderedDict()\n        for module_id, module in self._mfa_modules.items():\n            if await module.async_is_user_setup(user.id):\n                modules[module_id] = module.name\n        return modules\n\n    async def async_create_refresh_token(\n        self,\n        user: models.User,\n        client_id: str | None = None,\n        client_name: str | None = None,\n        client_icon: str | None = None,\n        token_type: str | None = None,\n        access_token_expiration: timedelta = ACCESS_TOKEN_EXPIRATION,\n        credential: models.Credentials | None = None,\n    ) -> models.RefreshToken:\n        \"\"\"Create a new refresh token for a user.\"\"\"\n        if not user.is_active:\n            raise ValueError(\"User is not active\")\n\n        if user.system_generated and client_id is not None:\n            raise ValueError(\n                \"System generated users cannot have refresh tokens connected \"\n                \"to a client.\"\n            )\n\n        if token_type is None:\n            if user.system_generated:\n                token_type = models.TOKEN_TYPE_SYSTEM\n            else:\n                token_type = models.TOKEN_TYPE_NORMAL\n\n        if token_type is models.TOKEN_TYPE_NORMAL:\n            expire_at = time.time() + REFRESH_TOKEN_EXPIRATION\n        else:\n            expire_at = None\n","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/auth/__init__.py#L445-L481","documentation":"Thrown by AuthManager.async_create_refresh_token (homeassistant/auth/__init__.py:463) when the user is not active (deactivated or the instance is in the 3-hour post-startup window where users default to inactive before onboarding completes). No refresh token may be minted for an inactive user.","triggerScenarios":"Calling async_create_refresh_token for a user deactivated via async_deactivate_user; calling it during startup before onboarding finished (new instances mark all users inactive until owner is created); long-lived token creation on a deactivated account.","commonSituations":"Custom auth scripts that don't check user.is_active; attempts to mint tokens for a deprovisioned user; test setup calling token creation against a mock user with is_active=False.","solutions":["Check `user.is_active` before calling and reject/return early in the caller","If the user was deactivated unintentionally, reactivate with hass.auth.async_activate_user first, then create the token","For fresh instances, wait for onboarding (EVENT_HOMEASSISTANT_STARTED / onboarding done) before creating tokens"],"exampleFix":"// before\nrefresh_token = await hass.auth.async_create_refresh_token(user, client_id)\n\n# after\nif not user.is_active:\n    raise or return early\nrefresh_token = await hass.auth.async_create_refresh_token(user, client_id)","handlingStrategy":"validation","validationCode":"if user.is_active:\n    refresh_token = await hass.auth.async_create_refresh_token(user, client_id)","typeGuard":"def can_mint_token(user) -> bool:\n    return user.is_active","tryCatchPattern":null,"preventionTips":["Always check user.is_active before token creation","Re-verify activation state after reactivating a user before retrying token creation","During fresh installs, wait until onboarding completes before issuing tokens"],"tags":["auth","python","home-assistant","refresh-token","valueerror"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}