{"record":{"id":"ade9de9943197571","repo":"Mintplex-Labs/anything-llm","slug":"registration-token-is-required","errorCode":null,"errorMessage":"Registration token is required","messagePattern":"Registration token is required","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"server/endpoints/mobile/middleware/index.js","lineNumber":58,"sourceCode":"    response.status(500).json({ error: \"Invalid middleware response\" });\n  }\n}\n\n/**\n * Validates a temporary registration token that is passed in the request\n * and associates the user with the token (if valid). Temporary token is consumed\n * and cannot be used again after this middleware is called.\n * @param {*} request\n * @param {*} response\n * @param {*} next\n */\nasync function validRegistrationToken(request, response, next) {\n  try {\n    const authHeader = request.header(\"Authorization\");\n    const tempToken = authHeader ? authHeader.split(\" \")[1] : null;\n    if (!tempToken)\n      return response\n        .status(400)\n        .json({ error: \"Registration token is required\" });\n\n    const tempTokenData = MobileDevice.tempToken(tempToken);\n    if (!tempTokenData)\n      return response\n        .status(400)\n        .json({ error: \"Invalid or expired registration token\" });\n\n    // If in multi-user mode, we need to validate the user id\n    // associated exists, is not banned and then associate with locals so we can reuse it later.\n    // If not in multi-user mode then simply having a valid token is enough.\n    const multiUserMode = await SystemSettings.isMultiUserMode();\n    if (multiUserMode) {\n      if (!tempTokenData.userId)\n        return response\n          .status(400)\n          .json({ error: \"User id not found in registration token\" });\n      const user = await User.get({ id: Number(tempTokenData.userId) });","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/endpoints/mobile/middleware/index.js#L40-L76","documentation":"validRegistrationToken guards POST /api/mobile/register. It reads the Authorization header and takes the second space-separated segment as the temporary token; if there is no Authorization header or no token segment, it responds 400 { error: 'Registration token is required' }.","triggerScenarios":"POST /api/mobile/register with no Authorization header, with 'Bearer' but no token, with a raw token lacking the 'Bearer ' prefix (split(' ')[1] is undefined), or with a non-space-separated scheme.","commonSituations":"Client puts the temp token in a custom header or the JSON body instead of Authorization: Bearer <t>; the t= param from the connect-info URL was never extracted before calling register.","solutions":["Send 'Authorization: Bearer <tempToken>' where tempToken is the t query param of the connect-info URL/QR","Keep the exact 'Bearer ' prefix with a single space","Parse ?t= from the connection URL before issuing the register request"],"exampleFix":"// before\nfetch('/api/mobile/register', {\n  method: 'POST',\n  headers: { 'x-registration-token': tempToken },\n  body: JSON.stringify({ deviceOs: 'android', deviceName }),\n});\n\n// after\nfetch('/api/mobile/register', {\n  method: 'POST',\n  headers: {\n    Authorization: `Bearer ${tempToken}`,\n    'Content-Type': 'application/json',\n  },\n  body: JSON.stringify({ deviceOs: 'android', deviceName }),\n});","handlingStrategy":"validation","validationCode":"if (!tempToken) throw new Error('No registration token — fetch connect-info first');\nconst headers = { Authorization: `Bearer ${tempToken}` };","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Build the Authorization header in one helper so every register call is uniform","Extract t= from the connect-info URL before attempting register","Remember: register uses Authorization Bearer; device routes use the x-anythingllm-mobile-device-token header"],"tags":["mobile","registration","auth","headers","bearer-token"],"backgroundTag":"missing-auth-header","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-08-23T16:17:53.355Z"}