calcom/cal.diy · error · UnauthorizedException

ApiAuthStrategy - access token - User associated with the ac

Error message

ApiAuthStrategy - access token - User associated with the access token not found.

What it means

Thrown by accessTokenStrategy when findByIdWithProfile(ownerId) returns null. The token has a valid owner id, but no matching User row exists in the database — typically because the user was deleted or hard-deleted after the token was issued.

Source

Thrown at apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts:290

    }

    if (origin && !isOriginAllowed(origin, client.redirectUris)) {
      throw new UnauthorizedException(
        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`
      );
    }

    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);

    if (!ownerId) {
      throw new UnauthorizedException(
        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`
      );
    }

    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(ownerId);
    if (!user) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - access token - User associated with the access token not found."
      );
    }

    const organizationId = this.usersService.getUserMainOrgId(user) as number;
    request.organizationId = organizationId;

    return user;
  }

  async nextAuthStrategy(token: { email?: string | null }, request: ApiAuthGuardRequest) {
    if (!token.email) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - next auth - Email not found in the authentication token."
      );
    }

    const user = await this.userRepository.findByEmailWithProfile(token.email);

View on GitHub (pinned to 176037d0af)

Solutions

Stop using the token; re-authenticate as a user that still exists in the workspace.
If the user was deleted in error, restore the user (or recreate the account) and re-issue tokens.
On user-deletion flows, proactively revoke that user's access tokens to surface the failure earlier as a 401-invalid-token.

Defensive patterns

Strategy: validation

Validate before calling

const me = await api.v2.me(); // or GET /v2/users/me equivalent
if (!me) throw new Error('Token owner is not a present user; re-authenticate');

Try / catch

try {
  await api.v2.someEndpoint();
} catch (err) {
  if (err?.statusCode === 401 && /access token not found/i.test(err?.message)) {
    await reauthenticateAsExistingUser();
  }
  throw err;
}

Prevention

On user-account deletion, revoke all of that user's access and refresh tokens.
When carrying tokens across environments, re-authenticate in the target environment.
Service integrations should hold their own credentials, not borrowed user tokens.

When it happens

Trigger: A platform request with a token whose owning user account was deleted (GDPR deletion, account removal) after the token was issued.

Common situations: User left the org and their account was purged; testing against a fixture DB that was reset; staging token used against a fresh prod account that lacks that user.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/fa266b946b4bbedb. Report an issue: GitHub.