{"record":{"id":"b92eba2a08a2632b","repo":"passbolt/passbolt_api","slug":"unable-to-authenticate-the-guest-user-with-the-provided-b92eba","errorCode":null,"errorMessage":"Unable to authenticate the guest user with the provided credentials. The registration authentication token is expired.","messagePattern":"Unable to authenticate the guest user with the provided credentials\\. The registration authentication token is expired\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php","lineNumber":121,"sourceCode":"        }\n\n        if (!Validation::uuid($authToken)) {\n            throw new BadRequestException(__('The authentication token must be a valid UUID.'));\n        }\n\n        $errorMsg = __('Unable to authenticate the guest user with the provided credentials.');\n\n        try {\n            (new AuthenticationTokenGetService())\n                ->getActiveNotExpiredOrFail($authToken, $userId, AuthenticationToken::TYPE_REGISTER);\n        } catch (NotFoundException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('No registration authentication token found for the given user.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (CustomValidationException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('The registration authentication token is expired.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (Exception $exception) {\n            throw new ForbiddenException($errorMsg, null, $exception); // phpcs:ignore\n        }\n    }\n}\n","sourceCodeStart":103,"sourceCodeEnd":127,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php#L103-L127","documentation":"This BadRequestException is thrown when the registration authentication token supplied by a guest exists in authentication_tokens but is expired or otherwise inactive. AuthenticationTokenGetService::getActiveNotExpiredOrFail raises CustomValidationException in that case, and the controller appends 'The registration authentication token is expired.' to the base message. It guards the unauthenticated key policy settings endpoint so only holders of a live register token may call it.","triggerScenarios":"GET /user-key-policies/settings as guest with user_id=<uuid>&token=<uuid> where a register-type token row exists for that user but its expiry (created + AuthenticationToken expiry delta) has passed, or the token is inactive.","commonSituations":"User delayed completing registration beyond the token lifetime; old setup bookmark reused; server clock skew makes an otherwise valid token appear expired.","solutions":["Issue a fresh registration token by restarting the user registration / setup invite flow and use the new token.","Check the token's created date against the expiry window in authentication_tokens to confirm expiry.","Verify server (and DB) timezone/clock are correct if the token should still be valid.","Complete registration and call the endpoint as an authenticated user instead of with a token."],"exampleFix":"// before: reusing a days-old setup link\nGET /user-key-policies/settings?user_id=<uuid>&token=<expired-register-token>\n// after: regenerate then use the new token\nGET /user-key-policies/settings?user_id=<uuid>&token=<fresh-register-token>","handlingStrategy":"validation","validationCode":"// client-side freshness check: token created within the expiry window\nconst created = new Date(tokenMeta.created);\nconst expires = created.getTime() + EXPIRY_MS;\nif (Date.now() > expires) throw new Error('register token expired - request a new one');","typeGuard":null,"tryCatchPattern":"try {\n  await get('/user-key-policies/settings', { user_id, token });\n} catch (e) {\n  if (e.status === 400 && /token is expired/.test(e.message)) {\n    token = await restartRegistrationFlow(user_id); // obtain fresh token and retry once\n  } else { throw e; }\n}","preventionTips":["Complete the registration/installer flow promptly after receiving the invitation.","Track the token creation time and refresh it before the expiry window elapses.","Keep server clocks NTP-synced so valid tokens are not seen as expired.","Fall back to authenticated access after registration instead of reusing tokens."],"tags":["authentication","token-expired","registration"],"backgroundTag":"jwt-token-expired","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}