{"record":{"id":"a73088310ec375f0","repo":"HumanSignal/label-studio","slug":"authentication-token-no-longer-valid-legacy-token","errorCode":null,"errorMessage":"Authentication token no longer valid: legacy token authentication has been disabled for this organization","messagePattern":"Authentication token no longer valid: legacy token authentication has been disabled for this organization","errorType":"http","errorClass":"AuthenticationFailed","httpStatus":401,"severity":"error","filePath":"label_studio/jwt_auth/auth.py","lineNumber":35,"sourceCode":"        from core.current_request import CurrentContext\n        from core.feature_flags import flag_set\n\n        auth_result = super().authenticate(request)\n\n        # Update CurrentContext with authenticated user\n        if auth_result is not None:\n            user, _ = auth_result\n            CurrentContext.set_user(user)\n\n        JWT_ACCESS_TOKEN_ENABLED = flag_set('fflag__feature_develop__prompts__dia_1829_jwt_token_auth')\n        if JWT_ACCESS_TOKEN_ENABLED and (auth_result is not None):\n            user, _ = auth_result\n            org = user.active_organization\n            org_id = org.id if org else None\n\n            # raise 401 if legacy API token auth disabled (i.e. this token is no longer valid)\n            if org and (not org.jwt.legacy_api_tokens_enabled):\n                raise AuthenticationFailed(\n                    'Authentication token no longer valid: legacy token authentication has been disabled for this organization'\n                )\n\n            logger.info(\n                'Legacy token authentication used',\n                extra={'user_id': user.id, 'organization_id': org_id, 'endpoint': request.path},\n            )\n        return auth_result\n\n\nclass JWTAuthScheme(OpenApiAuthenticationExtension):\n    target_class = 'jwt_auth.auth.TokenAuthenticationPhaseout'\n    name = 'Token'\n\n    def get_security_definition(self, auto_schema):\n        return {\n            'type': 'apiKey',\n            'name': 'Authorization',","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/HumanSignal/label-studio/blob/0b49e9b53917880baf1dd85d574fe5541a9aafb2/label_studio/jwt_auth/auth.py#L17-L53","documentation":"REST-framework AuthenticationFailed raised during legacy (non-JWT) API token authentication when the user's organization has disabled legacy API tokens. The user exists and the token matches, but the org policy makes the token no longer acceptable.","triggerScenarios":"Any authenticated API request (via authenticate/__call__ of the auth class) using an old-style API token while org.jwt.legacy_api_tokens_enabled is False; also surfaced through serializer clean().","commonSituations":"Organization upgraded to JWT-based LSAPIToken auth and an admin toggled legacy tokens off; scripts/integrations still storing the old API token; users copied old tokens from browser settings after migration.","solutions":["Generate a new JWT-based API token via the LSAPIToken endpoint (POST /api/auth/token or /api/sts/tokens)","Update scripts/clients to send the new token","If legacy tokens must keep working, have the organization admin re-enable legacy API tokens for the org","Ask the user to log out/in and re-issue credentials"],"exampleFix":"// before\ncurl -H 'Authorization: Token <legacy-token>' http://localhost:8080/api/projects/\n// after\ncurl -H 'Authorization: Token <new-jwt-api-token>' http://localhost:8080/api/projects/","handlingStrategy":"try-catch","validationCode":"const res = await fetch('/api/current-user/whoami', {headers:{Authorization:`Token ${tok}`}});\nif (res.status === 401 && (await res.text()).includes('legacy token')) {\n  await migrateToJwtToken();\n}","typeGuard":null,"tryCatchPattern":"try:\n    resp = requests.get(url, headers={'Authorization': f'Token {legacy_token}'})\n    resp.raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 401:\n        new_token = create_ls_api_token()\n        headers['Authorization'] = f'Token {new_token}'\n        resp = requests.get(url, headers=headers)","preventionTips":["Migrate to JWT LSAPITokens organization-wide","Centralize token issuance/refresh in one client helper","Re-issue tokens whenever org auth policy changes","Alert on 401s mentioning legacy tokens"],"tags":["auth","jwt","token","api"],"backgroundTag":"legacy-token-disabled","analyzedSha":"0b49e9b53917880baf1dd85d574fe5541a9aafb2","analyzedAt":"2026-08-29T00:39:52.578Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}