calcom/cal.diy · error · UnauthorizedException

ApiAuthStrategy - access token - Invalid request origin - pl

Error message

ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'

What it means

Thrown by accessTokenStrategy when the request carries an Origin header that isOriginAllowed() rejects against the OAuth client's redirectUris list. Cal.com enforces CORS/origin allow-listing per OAuth client: only origins registered in the client's Redirect URIs may use an access token. The message helpfully embeds the offending origin and the client id so the operator can fix the config.

Source

Thrown at apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts:275

    return user;
  }

  async accessTokenStrategy(accessToken: string, request: ApiAuthGuardRequest, origin?: string) {
    const accessTokenValid = await this.oauthFlowService.validateAccessToken(accessToken);
    if (!accessTokenValid) {
      throw new UnauthorizedException(`ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}`);
    }

    const client = await this.tokensRepository.getAccessTokenClient(accessToken);
    if (!client) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - access token - OAuth client not found given the access token"
      );
    }

    if (origin && !isOriginAllowed(origin, client.redirectUris)) {
      throw new UnauthorizedException(
        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`
      );
    }

    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);

    if (!ownerId) {
      throw new UnauthorizedException(
        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`
      );
    }

    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(ownerId);
    if (!user) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - access token - User associated with the access token not found."
      );
    }

View on GitHub (pinned to 176037d0af)

Solutions

1. Open https://app.cal.com/settings/platform and add the exact origin (scheme+host+port, no trailing slash) shown in the error to the OAuth client's Redirect URis.
2. If using a proxy, send requests from a registered server-side origin instead of directly from the browser.
3. Double-check scheme/port: `http://localhost:3000` and `https://localhost:3000` are distinct origins.

const allowed = await listClientRedirectUris(clientId);
const origin = new URL(requestOrigin).origin;
if (!allowed.includes(origin)) {
  throw new Error(`Add origin ${origin} to the OAuth client's Redirect URIs in Platform settings`);
}

When it happens

Trigger: A browser/spa client at https://staging.myapp.com calls /v2 with a Cal.com access token, but only https://myapp.com is listed in that OAuth client's Redirect URIs. Any cross-origin XHR/fetch from an unregistered host triggers it.

Common situations: Adding a new deployment domain (preview branch, staging, localhost dev), forgetting to add it to the platform OAuth client; scheme change (http -> https) treated as a new origin; trailing slash or port mismatch in the registered URI.

Related errors

• ApiAuthStrategy - access token - Invalid Access Token.
• ApiAuthStrategy - access token - OAuth client not found give
• ApiAuthStrategy - access token - Invalid Access Token.. No o
• ApiAuthStrategy - access token - User associated with the ac
• PermissionsGuard - no authentication provided. Provide eithe

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/6ae145fc19cabaab. Report an issue: GitHub.