{"record":{"id":"7937c62511f1efe4","repo":"calcom/cal.diy","slug":"apiauthstrategy-access-token-oauth-client-not","errorCode":null,"errorMessage":"ApiAuthStrategy - access token - OAuth client not found given the access token","messagePattern":"ApiAuthStrategy - access token - OAuth client not found given the access token","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts","lineNumber":269,"sourceCode":"    if (!apiKeyOwnerId) {\n      throw new UnauthorizedException(\"ApiAuthStrategy - api key - No user tied to this apiKey\");\n    }\n\n    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(apiKeyOwnerId);\n    request.organizationId = keyData.teamId;\n\n    return user;\n  }\n\n  async accessTokenStrategy(accessToken: string, request: ApiAuthGuardRequest, origin?: string) {\n    const accessTokenValid = await this.oauthFlowService.validateAccessToken(accessToken);\n    if (!accessTokenValid) {\n      throw new UnauthorizedException(`ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}`);\n    }\n\n    const client = await this.tokensRepository.getAccessTokenClient(accessToken);\n    if (!client) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - access token - OAuth client not found given the access token\"\n      );\n    }\n\n    if (origin && !isOriginAllowed(origin, client.redirectUris)) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`\n      );\n    }\n\n    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);\n\n    if (!ownerId) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`\n      );\n    }\n","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts#L251-L287","documentation":"Thrown in accessTokenStrategy when tokensRepository.getAccessTokenClient(accessToken) returns null. The access token passed validation but the system cannot find the OAuth client row that owns it. In Cal.com's OAuth model every access token is tied to an OAuth client; a missing client means the token is orphaned (its client was deleted) or the token was minted by something other than the platform OAuth server.","triggerScenarios":"A platform request with a valid-looking access token whose OAuth client record no longer exists (client deleted from the database), or a token forged/tampered such that it passes signature checks but points at no client row.","commonSituations":"The OAuth client was deleted from https://app.cal.com/settings/platform while tokens it issued were still in circulation; database restore/fixture mismatch where token rows exist but client rows do not.","solutions":["Issue a brand-new access token from a currently-existing OAuth client (re-run the OAuth authorize+token flow).","If the client was deleted accidentally, recreate it under Settings > Platform and re-issue tokens.","Verify your environment points at the correct database instance so token rows and client rows are consistent."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm the client the token was issued to still exists\nconst client = await getOAuthClient(clientId);\nif (!client) throw new Error('OAuth client no longer exists; recreate it and re-issue tokens');","typeGuard":null,"tryCatchPattern":"try {\n  await api.v2.someEndpoint();\n} catch (err) {\n  if (err?.statusCode === 401 && /OAuth client not found/i.test(err?.message)) {\n    await recreateOAuthClient(); // then re-run authorize+token flow\n  }\n  throw err;\n}","preventionTips":["Treat OAuth client deletion as a hard invalidation: revoke its tokens at the same time.","Run the full OAuth flow (authorize -> token) when integrating, rather than reusing tokens from deleted clients.","On client deletion in admin tooling, cascade-delete or revoke its access tokens."],"tags":["auth","oauth","oauth-client","api-v2","platform"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}