{"record":{"id":"b36b8224d12469e8","repo":"apolloconfig/apollo","slug":"token-is-not-active","errorCode":null,"errorMessage":"Token is not active","messagePattern":"Token is not active","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/UserTokenService.java","lineNumber":194,"sourceCode":"\n  private void deleteToken(UserToken userToken, String operator) {\n    validateOperator(operator);\n    if (userToken.getRevokedAt() == null) {\n      Date now = new Date();\n      userToken.setRevokedAt(now);\n      userToken.setRevokedBy(operator);\n      userToken.setDataChangeLastModifiedBy(operator);\n      userToken.setDataChangeLastModifiedTime(now);\n      userTokenRepository.saveAndFlush(userToken);\n    }\n    userTokenRepository.delete(userToken);\n  }\n\n  @Transactional\n  public UserTokenInfo rotateToken(long tokenId, String operator) {\n    UserToken userToken = findOwnedToken(tokenId, operator);\n    if (userToken.getRevokedAt() != null || userToken.getExpires().before(new Date())) {\n      throw new BadRequestException(\"Token is not active\");\n    }\n\n    UserTokenCreateRequest request = new UserTokenCreateRequest();\n    request.setName(userToken.getName());\n    UserTokenScope scope = parseScope(userToken);\n    request.setOperations(scope.getOperations());\n    request.setAppIds(scope.getAppIds());\n    request.setEnvs(scope.getEnvs());\n    request.setNamespaces(scope.getNamespaces());\n    request.setRateLimit(userToken.getRateLimit());\n    request.setExpires(userToken.getExpires());\n\n    revokeToken(tokenId, operator);\n    return createToken(request, operator);\n  }\n\n  @Transactional\n  public UserToken authenticate(String token, HttpServletRequest request) {","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/UserTokenService.java#L176-L212","documentation":"Thrown as a BadRequestException by UserTokenService.rotateToken() when the token being rotated is either revoked (revokedAt is not null) or expired (expires date is before now). Token rotation replaces an old token with a new one carrying the same scope and settings, but this is only allowed for active tokens. An inactive token cannot be rotated.","triggerScenarios":"Calling rotateToken with a tokenId whose UserToken has been previously revoked (revokedAt set) or whose expiration date has passed. The check fires after findOwnedToken confirms the token exists and belongs to the operator, but before creating the replacement token.","commonSituations":"Attempting to rotate a token that was already revoked via revokeToken; token has naturally expired and the user tries to rotate instead of creating a new one; stale UI showing an expired/revoked token as rotatable; clock skew between server and token expiry.","solutions":["Create a new token via createToken instead of rotating an expired or revoked one.","Check the token's status (revokedAt, expires) in the token management UI before attempting rotation.","Rotate tokens before they expire to avoid this error — set up a rotation reminder based on the expires date.","If the token appears active but still fails, check for server clock skew."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check token is active before rotating\nUserToken token = userTokenRepository.findById(tokenId).orElse(null);\nif (token == null) {\n  throw new IllegalArgumentException(\"Token not found: \" + tokenId);\n}\nif (token.getRevokedAt() != null || token.getExpires().before(new Date())) {\n  throw new IllegalStateException(\n    \"Token is not active. Create a new token instead of rotating.\");\n}\nuserTokenService.rotateToken(tokenId, operator);","typeGuard":null,"tryCatchPattern":"try {\n  userTokenService.rotateToken(tokenId, operator);\n} catch (BadRequestException e) {\n  if (e.getMessage().contains(\"Token is not active\")) {\n    log.warn(\"Cannot rotate inactive token {}. Create a new token instead.\", tokenId);\n    // redirect to token creation flow\n  }\n  throw e;\n}","preventionTips":["Rotate tokens proactively before their expiration date.","Check token status in the management UI before attempting rotation.","If a token is expired or revoked, create a new token rather than rotating."],"tags":["apollo-portal","user-token","bad-request","rotation","expired","revoked"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}