calcom/cal.diy · error · UnauthorizedException

ApiAuthStrategy - access token - Invalid Access Token.. No o

Error message

ApiAuthStrategy - access token - Invalid Access Token.. No owner found for this access token.

What it means

Thrown by accessTokenStrategy after getAccessTokenOwnerId(accessToken) returns null. The token validated and its client was found, but no user is recorded as the token's owner — an orphaned token. INVALID_ACCESS_TOKEN constant prefixes the message, signalling to the caller that the token should be treated as invalid even though the underlying row exists.

Source

Thrown at apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts:283

    }

    const client = await this.tokensRepository.getAccessTokenClient(accessToken);
    if (!client) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - access token - OAuth client not found given the access token"
      );
    }

    if (origin && !isOriginAllowed(origin, client.redirectUris)) {
      throw new UnauthorizedException(
        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`
      );
    }

    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);

    if (!ownerId) {
      throw new UnauthorizedException(
        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`
      );
    }

    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(ownerId);
    if (!user) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - access token - User associated with the access token not found."
      );
    }

    const organizationId = this.usersService.getUserMainOrgId(user) as number;
    request.organizationId = organizationId;

    return user;
  }

  async nextAuthStrategy(token: { email?: string | null }, request: ApiAuthGuardRequest) {

View on GitHub (pinned to 176037d0af)

Solutions

Discard the current token and run the user-consent OAuth flow (the one that ends with a user id on the token) to mint a fresh access token.
Audit the oauth flow table / tokens table for rows where ownerId is null and clean them up.
Make sure your integration requests authorization for a specific user rather than a userless client-credentials grant.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await api.v2.someEndpoint();
} catch (err) {
  if (err?.statusCode === 401 && /No owner found for this access token/i.test(err?.message)) {
    accessToken = await runUserConsentFlow(); // mint a user-scoped token
    return api.v2.someEndpoint();
  }
  throw err;
}

Prevention

Only mint access tokens through the user-consent OAuth flow so every token carries an ownerId.
On user deletion, cascade-revoke that user's access tokens to fail fast.
Audit token rows for null ownerId during data migrations.

When it happens

Trigger: The access-token row exists in the tokens table but its ownerUserId column is null or points at nothing; can happen with a partially-written/migrated token row or a token minted for a client-credentials flow with no user principal.

Common situations: Direct database edits that created a token without an owner; a migration that lost the owner linkage; using a client-credentials-style token where a user-scoped token is required.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/33090573c093def7. Report an issue: GitHub.