{"record":{"id":"6a9a5eb83ac07e4a","repo":"actualbudget/actual","slug":"authentication-required-set-password-session","errorCode":null,"errorMessage":"Authentication required. Set --password/--session-token, ACTUAL_PASSWORD/ACTUAL_SESSION_TOKEN env var, or password/sessionToken in config file.","messagePattern":"Authentication required\\. Set --password/--session-token, ACTUAL_PASSWORD/ACTUAL_SESSION_TOKEN env var, or password/sessionToken in config file\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cli/src/config.ts","lineNumber":187,"sourceCode":"  const dataDir =\n    cliOpts.dataDir ??\n    process.env.ACTUAL_DATA_DIR ??\n    fileConfig.dataDir ??\n    join(homedir(), '.actual-cli', 'data');\n\n  const encryptionPassword =\n    cliOpts.encryptionPassword ??\n    process.env.ACTUAL_ENCRYPTION_PASSWORD ??\n    fileConfig.encryptionPassword;\n\n  if (!serverUrl) {\n    throw new Error(\n      'Server URL is required. Set --server-url, ACTUAL_SERVER_URL env var, or serverUrl in config file.',\n    );\n  }\n\n  if (!password && !sessionToken) {\n    throw new Error(\n      'Authentication required. Set --password/--session-token, ACTUAL_PASSWORD/ACTUAL_SESSION_TOKEN env var, or password/sessionToken in config file.',\n    );\n  }\n\n  const cacheTtl = validateNonNegativeInt(\n    cliOpts.cacheTtl ??\n      parseNonNegativeIntEnv(\n        process.env.ACTUAL_CACHE_TTL,\n        'ACTUAL_CACHE_TTL',\n      ) ??\n      fileConfig.cacheTtl ??\n      60,\n    'cacheTtl',\n  );\n\n  const lockTimeout = validateNonNegativeInt(\n    cliOpts.lockTimeout ??\n      parseNonNegativeIntEnv(","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/actualbudget/actual/blob/d4334cb6e6123f4d3bcea1ad6166608884c7e658/packages/cli/src/config.ts#L169-L205","documentation":"resolveConfig requires some form of authentication: a password or a session token, from CLI flags, environment variables, or the config file. When neither is present after merging all sources, it throws this error. A server URL alone is not enough to connect.","triggerScenarios":"Running a command with --server-url set but no --password/--session-token, no ACTUAL_PASSWORD/ACTUAL_SESSION_TOKEN env vars, and no password/sessionToken in the config file.","commonSituations":"Setting only ACTUAL_SERVER_URL in CI; password stored in a dotenv file that is not loaded; typos like ACTUAL_PASSWORDS or using the sync-server's own env names incorrectly.","solutions":["Provide --password or --session-token on the command line.","Export ACTUAL_PASSWORD or ACTUAL_SESSION_TOKEN in the environment.","Add password or sessionToken to the config file (prefer sessionToken to avoid storing plaintext passwords).","Ensure your .env / dotenv file is actually loaded by the shell or CI job."],"exampleFix":"// before\nactual-cli budgets --server-url=https://actual.example.com\n// after\nactual-cli budgets --server-url=https://actual.example.com --password \"$ACTUAL_PASSWORD\"","handlingStrategy":"validation","validationCode":"const hasAuth = Boolean(\n  cliOpts.password ?? process.env.ACTUAL_PASSWORD ?? fileConfig.password ??\n  cliOpts.sessionToken ?? process.env.ACTUAL_SESSION_TOKEN ?? fileConfig.sessionToken,\n);\nif (!hasAuth) throw new Error('Authentication required before invoking the CLI.');","typeGuard":"function hasCredentials(c: { password?: string; sessionToken?: string }): c is typeof c & ({ password: string } | { sessionToken: string }) {\n  return Boolean(c.password || c.sessionToken);\n}","tryCatchPattern":"try {\n  await run(cmdOpts);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Authentication required')) {\n    console.error('Provide ACTUAL_PASSWORD or ACTUAL_SESSION_TOKEN (or config file equivalents).');\n    process.exit(1);\n  }\n  throw err;\n}","preventionTips":["Store credentials in CI secrets and export them in every job step.","Prefer ACTUAL_SESSION_TOKEN over plaintext passwords.","Load your .env file explicitly (set -a; source .env; set +a) in scripts.","Verify secrets with `[ -n \"$ACTUAL_PASSWORD\" ] || exit 1` guards in shell scripts."],"tags":["auth","cli","env","missing-option"],"backgroundTag":"missing-credentials","analyzedSha":"d4334cb6e6123f4d3bcea1ad6166608884c7e658","analyzedAt":"2026-08-29T01:02:11.213Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}