{"record":{"id":"fa266b946b4bbedb","repo":"calcom/cal.diy","slug":"apiauthstrategy-access-token-user-associated-w","errorCode":null,"errorMessage":"ApiAuthStrategy - access token - User associated with the access token not found.","messagePattern":"ApiAuthStrategy - access token - User associated with the access token not found\\.","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts","lineNumber":290,"sourceCode":"    }\n\n    if (origin && !isOriginAllowed(origin, client.redirectUris)) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`\n      );\n    }\n\n    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);\n\n    if (!ownerId) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`\n      );\n    }\n\n    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(ownerId);\n    if (!user) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - access token - User associated with the access token not found.\"\n      );\n    }\n\n    const organizationId = this.usersService.getUserMainOrgId(user) as number;\n    request.organizationId = organizationId;\n\n    return user;\n  }\n\n  async nextAuthStrategy(token: { email?: string | null }, request: ApiAuthGuardRequest) {\n    if (!token.email) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - next auth - Email not found in the authentication token.\"\n      );\n    }\n\n    const user = await this.userRepository.findByEmailWithProfile(token.email);","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts#L272-L308","documentation":"Thrown by accessTokenStrategy when findByIdWithProfile(ownerId) returns null. The token has a valid owner id, but no matching User row exists in the database — typically because the user was deleted or hard-deleted after the token was issued.","triggerScenarios":"A platform request with a token whose owning user account was deleted (GDPR deletion, account removal) after the token was issued.","commonSituations":"User left the org and their account was purged; testing against a fixture DB that was reset; staging token used against a fresh prod account that lacks that user.","solutions":["Stop using the token; re-authenticate as a user that still exists in the workspace.","If the user was deleted in error, restore the user (or recreate the account) and re-issue tokens.","On user-deletion flows, proactively revoke that user's access tokens to surface the failure earlier as a 401-invalid-token."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const me = await api.v2.me(); // or GET /v2/users/me equivalent\nif (!me) throw new Error('Token owner is not a present user; re-authenticate');","typeGuard":null,"tryCatchPattern":"try {\n  await api.v2.someEndpoint();\n} catch (err) {\n  if (err?.statusCode === 401 && /access token not found/i.test(err?.message)) {\n    await reauthenticateAsExistingUser();\n  }\n  throw err;\n}","preventionTips":["On user-account deletion, revoke all of that user's access and refresh tokens.","When carrying tokens across environments, re-authenticate in the target environment.","Service integrations should hold their own credentials, not borrowed user tokens."],"tags":["auth","oauth","user","platform","data-integrity"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}