{"record":{"id":"7be9db75e4979725","repo":"appwrite/appwrite","slug":"organization-id-missing","errorCode":"organization_id_missing","errorMessage":"When using organization API key, make sure to pass x-appwrite-organization header with your organization ID.","messagePattern":"When using organization API key, make sure to pass x-appwrite-organization header with your organization ID\\.","errorType":"exception","errorClass":"Appwrite\\Extend\\Exception","httpStatus":403,"severity":"error","filePath":"app/init/resources/request.php","lineNumber":1054,"sourceCode":"        $userHeader = $request->getHeaderLine('x-appwrite-user');\n        $organizationHeader = $request->getHeaderLine('x-appwrite-organization');\n        $projectHeader = $request->getHeaderLine('x-appwrite-project');\n\n        if (! empty($key->getProjectId())) {\n            if (empty($projectHeader) || $projectHeader !== $key->getProjectId()) {\n                throw new Exception(Exception::PROJECT_ID_MISSING);\n            }\n        }\n\n        if (! empty($key->getUserId())) {\n            if (empty($userHeader) || $userHeader !== $key->getUserId()) {\n                throw new Exception(Exception::USER_ID_MISSING);\n            }\n        }\n\n        if (! empty($key->getTeamId())) {\n            if (empty($organizationHeader) || $organizationHeader !== $key->getTeamId()) {\n                throw new Exception(Exception::ORGANIZATION_ID_MISSING);\n            }\n        }\n\n        return $key;\n    }, ['request', 'project', 'team', 'user']);\n\n    $context->set('resourceToken', function ($project, $dbForProject, $request, Authorization $authorization) {\n        $tokenJWT = $request->getParam('token');\n\n        if (! empty($tokenJWT) && ! $project->isEmpty()) { // JWT authentication\n            // Use a large but reasonable maxAge to avoid auto-exp when token has no expiry\n            $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), RESOURCE_TOKEN_ALGORITHM, RESOURCE_TOKEN_MAX_AGE, RESOURCE_TOKEN_LEEWAY); // Instantiate with key, algo, maxAge and leeway.\n\n            try {\n                $payload = $jwt->decode($tokenJWT);\n            } catch (JWTException $error) {\n                return new Document([]);\n            }","sourceCodeStart":1036,"sourceCodeEnd":1072,"githubUrl":"https://github.com/appwrite/appwrite/blob/cd368e707d4b492bc5e8e9c0f8ecbc5b741c4bf4/app/init/resources/request.php#L1036-L1072","documentation":"Thrown in the organization-API-key validator (app/init/resources/request.php:1054) when a decoded API key carries a teamId but the x-appwrite-organization header is missing or does not match. Binds the key to its issuing organization.","triggerScenarios":"Client authenticates with an organization API key whose payload includes a teamId, but x-appwrite-organization is absent or mismatched. The check at line ~1052 compares $organizationHeader !== $key->getTeamId().","commonSituations":"SDK not configured to send x-appwrite-organization when using an org API key; header stripped by proxy; key for team A used against a client pointing at team B; multi-org setup missing the header.","solutions":["Set x-appwrite-organization to the key's teamId.","Confirm the teamId in the key matches the organization the client targets.","Ensure proxies do not strip x-appwrite-organization.","Configure the SDK to send both the key and the organization header together."],"exampleFix":"// before\nclient.setHeader('x-appwrite-key', orgApiKey);\n// after\nclient.setHeader('x-appwrite-key', orgApiKey);\nclient.setHeader('x-appwrite-organization', teamId);","handlingStrategy":"validation","validationCode":"// Ensure x-appwrite-organization is set whenever an org API key is used\nfunction ensureOrgHeader(headers, keyTeamId) {\n  if (keyTeamId && headers['x-appwrite-organization'] !== keyTeamId) {\n    headers['x-appwrite-organization'] = keyTeamId;\n  }\n  return headers;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When using an org API key, always set x-appwrite-organization to the key's teamId.","Ensure proxies forward x-appwrite-organization.","Keep the key and the org header paired in SDK configuration."],"tags":["authentication","api-key","headers","organization","http"],"backgroundTag":null,"analyzedSha":"cd368e707d4b492bc5e8e9c0f8ecbc5b741c4bf4","analyzedAt":"2026-08-12T14:42:48.571Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}