calcom/cal.diy · error · UnauthorizedException

ApiAuthStrategy - next auth - User associated with the authe

Error message

ApiAuthStrategy - next auth - User associated with the authentication token email not found.

What it means

Thrown by nextAuthStrategy when userRepository.findByEmailWithProfile(token.email) returns null. The decoded NextAuth token had a valid email claim, but no User row matches that email in the database the API v2 is connected to.

Source

Thrown at apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts:310

      );
    }

    const organizationId = this.usersService.getUserMainOrgId(user) as number;
    request.organizationId = organizationId;

    return user;
  }

  async nextAuthStrategy(token: { email?: string | null }, request: ApiAuthGuardRequest) {
    if (!token.email) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - next auth - Email not found in the authentication token."
      );
    }

    const user = await this.userRepository.findByEmailWithProfile(token.email);
    if (!user) {
      throw new UnauthorizedException(
        "ApiAuthStrategy - next auth - User associated with the authentication token email not found."
      );
    }
    const organizationId = this.usersService.getUserMainOrgId(user) as number;
    request.organizationId = organizationId;

    return user;
  }

  async validateThirdPartyAccessToken(
    token: string,
    request: ApiAuthGuardRequest
  ): Promise<{ success: true; data: UserWithProfile } | { success: false }> {
    const decodedToken = this.tokensService.getDecodedThirdPartyAccessToken(token);
    if (!decodedToken) {
      return { success: false };
    }

View on GitHub (pinned to 176037d0af)

Solutions

Re-authenticate via the web app for this environment so a fresh session cookie tied to an existing user is issued.
Confirm the user exists with `SELECT id,email FROM users WHERE email = '<token.email>'` against the same DB.
Prefer platform OAuth access tokens or API keys for service-to-service calls instead of session cookies.

Defensive patterns

Strategy: validation

Validate before calling

const payload = decodeJwt(sessionJwt);
const exists = await db.user.findFirst({ where: { email: payload.email } });
if (!exists) throw new Error('No user for this session email; re-authenticate in this environment');

Prevention

Re-authenticate in the target environment rather than reusing session cookies elsewhere.
Normalize email casing on session creation and user lookup.
Cascade-revoke sessions when a user is deleted.

When it happens

Trigger: A NextAuth session cookie for a user that does not exist in this Cal.com instance (e.g., a token minted by another deployment, or the user was deleted after the session was created).

Common situations: Carrying a session cookie across environments (dev cookie against prod); user account was deleted; email address changed/case-difference between the token and the DB.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/4141154b59a7cb69. Report an issue: GitHub.