apolloconfig/apollo · error · AccessDeniedException

User token is required

Error message

User token is required

What it means

Thrown by requireUserToken when the auth type is not USER_TOKEN or when no user token can be retrieved from the request context.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserTokenOpenApiController.java:417

    capability.setDataChangeCreatedTime(toOffsetDateTime(userToken.getDataChangeCreatedTime()));
    capability.setDenyAll(scope.isDenyAll());
    capability.setOperations(new LinkedHashSet<>(scope.getOperations()));
    capability.setAllOperations(!scope.isDenyAll() && scope.getOperations().isEmpty());
    capability.setAppIds(new LinkedHashSet<>(scope.getAppIds()));
    capability.setAllApps(!scope.isDenyAll() && scope.getAppIds().isEmpty());
    capability.setEnvs(new LinkedHashSet<>(scope.getEnvs()));
    capability.setAllEnvs(!scope.isDenyAll() && scope.getEnvs().isEmpty());
    capability.setNamespaces(scope.getNamespaces().stream()
        .map(UserTokenOpenApiController::toOpenNamespaceScope).collect(Collectors.toList()));
    capability.setAllNamespaces(!scope.isDenyAll() && scope.getNamespaces().isEmpty());
    capability.setActions(actionsFor(scope).stream().map(UserTokenOpenApiController::toOpenAction)
        .collect(Collectors.toList()));
    return ResponseEntity.ok(capability);
  }

  private UserToken requireUserToken() {
    if (!UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {
      throw new AccessDeniedException("User token is required");
    }
    UserToken userToken = userTokenAuthUtil.retrieveUserTokenFromCtx();
    if (userToken == null) {
      throw new AccessDeniedException("User token is required");
    }
    return userToken;
  }

  private List<UserTokenOpenApiAction> actionsFor(UserTokenScope scope) {
    return ACTION_CATALOG.stream().filter(action -> allowsAction(scope, action))
        .map(action -> withGrantedOperations(scope, action)).collect(Collectors.toList());
  }

  private boolean allowsAction(UserTokenScope scope, UserTokenOpenApiAction action) {
    List<String> requiredOperations = action.getRequiredOperations();
    if (requiredOperations == null || requiredOperations.isEmpty()) {
      return true;
    }

View on GitHub (pinned to d95fc18d11)

Solutions

1. Send the request with a valid user token (auth type USER_TOKEN); sessions and consumer tokens are rejected by this endpoint.
2. Ensure the user token is present in the request context and resolvable to an existing token record.

When it happens

Trigger: Thrown when the UserToken OpenAPI endpoint is called without supplying the required user token in the request header or parameter.

Common situations: Missing token header; blank token value; token stripped by a proxy.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/59fa1ca7ae915b3a. Report an issue: GitHub.