What causes "Token is not active" in apolloconfig/apollo?

Create a new token via createToken instead of rotating an expired or revoked one.

apolloconfig/apollo · error · BadRequestException

Token is not active

Error message

Token is not active

What it means

Thrown as a BadRequestException by UserTokenService.rotateToken() when the token being rotated is either revoked (revokedAt is not null) or expired (expires date is before now). Token rotation replaces an old token with a new one carrying the same scope and settings, but this is only allowed for active tokens. An inactive token cannot be rotated.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/UserTokenService.java:194

  private void deleteToken(UserToken userToken, String operator) {
    validateOperator(operator);
    if (userToken.getRevokedAt() == null) {
      Date now = new Date();
      userToken.setRevokedAt(now);
      userToken.setRevokedBy(operator);
      userToken.setDataChangeLastModifiedBy(operator);
      userToken.setDataChangeLastModifiedTime(now);
      userTokenRepository.saveAndFlush(userToken);
    }
    userTokenRepository.delete(userToken);
  }

  @Transactional
  public UserTokenInfo rotateToken(long tokenId, String operator) {
    UserToken userToken = findOwnedToken(tokenId, operator);
    if (userToken.getRevokedAt() != null || userToken.getExpires().before(new Date())) {
      throw new BadRequestException("Token is not active");
    }

    UserTokenCreateRequest request = new UserTokenCreateRequest();
    request.setName(userToken.getName());
    UserTokenScope scope = parseScope(userToken);
    request.setOperations(scope.getOperations());
    request.setAppIds(scope.getAppIds());
    request.setEnvs(scope.getEnvs());
    request.setNamespaces(scope.getNamespaces());
    request.setRateLimit(userToken.getRateLimit());
    request.setExpires(userToken.getExpires());

    revokeToken(tokenId, operator);
    return createToken(request, operator);
  }

  @Transactional
  public UserToken authenticate(String token, HttpServletRequest request) {

View on GitHub (pinned to d95fc18d11)

Solutions

Create a new token via createToken instead of rotating an expired or revoked one.
Check the token's status (revokedAt, expires) in the token management UI before attempting rotation.
Rotate tokens before they expire to avoid this error — set up a rotation reminder based on the expires date.
If the token appears active but still fails, check for server clock skew.

Defensive patterns

Strategy: validation

Validate before calling

// Check token is active before rotating
UserToken token = userTokenRepository.findById(tokenId).orElse(null);
if (token == null) {
  throw new IllegalArgumentException("Token not found: " + tokenId);
}
if (token.getRevokedAt() != null || token.getExpires().before(new Date())) {
  throw new IllegalStateException(
    "Token is not active. Create a new token instead of rotating.");
}
userTokenService.rotateToken(tokenId, operator);

Try / catch

try {
  userTokenService.rotateToken(tokenId, operator);
} catch (BadRequestException e) {
  if (e.getMessage().contains("Token is not active")) {
    log.warn("Cannot rotate inactive token {}. Create a new token instead.", tokenId);
    // redirect to token creation flow
  }
  throw e;
}

Prevention

Rotate tokens proactively before their expiration date.
Check token status in the management UI before attempting rotation.
If a token is expired or revoked, create a new token rather than rotating.

When it happens

Trigger: Calling rotateToken with a tokenId whose UserToken has been previously revoked (revokedAt set) or whose expiration date has passed. The check fires after findOwnedToken confirms the token exists and belongs to the operator, but before creating the replacement token.

Common situations: Attempting to rotate a token that was already revoked via revokeToken; token has naturally expired and the user tries to rotate instead of creating a new one; stale UI showing an expired/revoked token as rotatable; clock skew between server and token expiry.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/b36b8224d12469e8. Report an issue: GitHub.