{"record":{"id":"ccbb992e69ab2d04","repo":"Mintplex-Labs/anything-llm","slug":"cannot-create-jwt-as-jwt-secret-is-unset","errorCode":null,"errorMessage":"Cannot create JWT as JWT_SECRET is unset.","messagePattern":"Cannot create JWT as JWT_SECRET is unset\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"server/utils/http/index.js","lineNumber":27,"sourceCode":"function reqBody(request) {\n  return typeof request.body === \"string\"\n    ? JSON.parse(request.body)\n    : request.body;\n}\n\nfunction queryParams(request) {\n  return request.query;\n}\n\n/**\n * Creates a JWT with the given info and expiry\n * @param {object} info - The info to include in the JWT\n * @param {string} expiry - The expiry time for the JWT (default: 30 days)\n * @returns {string} The JWT\n */\nfunction makeJWT(info = {}, expiry = \"30d\") {\n  if (!process.env.JWT_SECRET)\n    throw new Error(\"Cannot create JWT as JWT_SECRET is unset.\");\n  return JWT.sign(info, process.env.JWT_SECRET, { expiresIn: expiry });\n}\n\n/**\n * Gets the user from the session\n * Note: Only valid for multi-user mode\n * as single-user mode with password is not a \"user\"\n * @param {import(\"express\").Request} request - The request object\n * @param {import(\"express\").Response} response - The response object\n * @returns {Promise<import(\"@prisma/client\").users | null>} The user\n */\nasync function userFromSession(request, response = null) {\n  if (!!response && !!response.locals?.user) {\n    return response.locals.user;\n  }\n\n  const auth = request.header(\"Authorization\");\n  const token = auth ? auth.split(\" \")[1] : null;","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/utils/http/index.js#L9-L45","documentation":"Thrown by makeJWT() when process.env.JWT_SECRET is falsy. The function signs JWTs for sessions and API tokens; without a secret, signing is impossible and would silently produce an insecure token, so it refuses. AnythingLLM expects JWT_SECRET to be set in multi-user mode; in single-user mode it may also be required for system features.","triggerScenarios":"Booting the server without JWT_SECRET in .env; a Docker container missing the env var; running in an environment where the .env file wasn't loaded (wrong NODE_ENV path). Any login, session creation, or API-key issuance path that calls makeJWT.","commonSituations":"Fresh install that skipped the env bootstrap; a deployment that rotated secrets and forgot to redeploy; CI running without the secret; switching NODE_ENV so a different .env file is loaded.","solutions":["Set JWT_SECRET in .env to a long random string (e.g. `openssl rand -hex 32`).","For Docker, pass -e JWT_SECRET=... or mount the env file.","Add a startup check that fails fast with a clear message if JWT_SECRET is missing.","Re-issue existing sessions/tokens after rotating the secret, since old tokens become invalid."],"exampleFix":"// before\n// .env has no JWT_SECRET -> makeJWT throws on first login\n\n// after\n// .env\nJWT_SECRET=9f2c...long-random-hex...\n\n// server bootstrap\nif (!process.env.JWT_SECRET && MULTI_USER_MODE)\n  throw new Error('JWT_SECRET is required in multi-user mode');","handlingStrategy":"validation","validationCode":"if (!process.env.JWT_SECRET || process.env.JWT_SECRET.length < 16)\n  throw new Error('JWT_SECRET must be set to a strong random string');","typeGuard":"function hasJwtSecret(): boolean {\n  return typeof process.env.JWT_SECRET === 'string' && process.env.JWT_SECRET.length > 0;\n}","tryCatchPattern":"try {\n  const token = makeJWT(info, expiry);\n} catch (e) {\n  if (e.message.includes('JWT_SECRET is unset'))\n    return res.status(503).json({ error: 'Server auth not configured' });\n  throw e;\n}","preventionTips":["Set JWT_SECRET via `openssl rand -hex 32` in .env and in Docker env.","Add a startup assertion so the server fails fast if missing.","Rotate the secret with a redeploy; old tokens become invalid."],"tags":["auth","jwt","config","environment","security"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}