{"record":{"id":"8fd055b0809e974a","repo":"RocketChat/Rocket.Chat","slug":"error-app-user-is-not-allowed-to-login","errorCode":"error-app-user-is-not-allowed-to-login","errorMessage":"App user is not allowed to login","messagePattern":"App user is not allowed to login","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/startup.js","lineNumber":433,"sourceCode":"\t\t});\n\t}\n\n\tif (!(await isValidAttemptByUser(login))) {\n\t\tthrow new Meteor.Error('error-login-blocked-for-user', 'Login has been temporarily blocked For User', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (login.allowed !== true) {\n\t\treturn login.allowed;\n\t}\n\n\tif (login.user.type === 'visitor') {\n\t\treturn true;\n\t}\n\n\tif (login.user.type === 'app') {\n\t\tthrow new Meteor.Error('error-app-user-is-not-allowed-to-login', 'App user is not allowed to login', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!!login.user.active !== true) {\n\t\tthrow new Meteor.Error('error-user-is-not-activated', 'User is not activated', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!login.user.roles || !Array.isArray(login.user.roles)) {\n\t\tthrow new Meteor.Error('error-user-has-no-roles', 'User has no roles', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (login.user.roles.includes('admin') === false && login.type === 'password' && settings.get('Accounts_EmailVerification') === true) {\n\t\tconst validEmail = login.user.emails.filter((email) => email.verified === true);","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/startup.js#L415-L451","documentation":"Accounts.validateLoginAttempt throws error-app-user-is-not-allowed-to-login when the authenticating account has type 'app'. Users with type 'app' are internal service accounts created by the Apps Engine (bots), and Rocket.Chat forbids them from establishing interactive login sessions. The check runs after the IP/user block checks, once login.allowed is true.","triggerScenarios":"Calling LoginWithPassword / POST /api/v1/login or any interactive auth flow with the credentials of a bot user whose user.type === 'app'; scripts, load tests, or dashboards reusing app-user credentials.","commonSituations":"Teams reuse the bot account's username/password for automation instead of creating a dedicated user; a human account was wrongly flagged type 'app' by a bad data import; the app user was re-created by the Apps Engine after an app reinstall.","solutions":["Create a dedicated normal user (type 'user') for scripts/integrations and use its credentials or a personal access token","If the account should be human, repair the document: set type back to 'user' in the Users collection / admin user edit","Never use Apps Engine bot credentials for interactive login flows"],"exampleFix":"// before\nawait sdk.login({ user: 'my-bot.user', password: '...' });\n// bot has type 'app' -> error-app-user-is-not-allowed-to-login\n\n// after\n// create a normal integration user, then:\nawait sdk.login({ user: 'integration.user', password: '...' });\n// or authenticate with headers: X-Auth-Token + X-User-Id (personal access token)","handlingStrategy":"validation","validationCode":"const canLoginInteractively = (user: { type?: string } | null | undefined): boolean =>\n  !!user && user.type !== 'app';\n\nconst account = await Users.findOneByUsername(username);\nif (!canLoginInteractively(account)) {\n  throw new Error('App users cannot log in interactively; use a normal user or a personal access token');\n}","typeGuard":"const isAppUser = (u: { type?: string } | null | undefined): u is { type: 'app' } =>\n  u?.type === 'app';","tryCatchPattern":"try {\n  await login(user, password);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-app-user-is-not-allowed-to-login') {\n    // permanent: switch to a non-app account or token-based auth\n  }\n  throw e;\n}","preventionTips":["Provision dedicated integration users separate from Apps Engine bots","Store credentials only for real accounts; derive bot identity via the Apps Engine API","Tag automation accounts in naming conventions to avoid accidental reuse of bot credentials"],"tags":["authentication","login","apps-engine","bot-accounts"],"backgroundTag":"bot-account-login-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}