What causes "Authentication failed: ${error.message}" in danny-avila/LibreChat?

Inspect the wrapped error.message (it is included) to find the underlying cause.

danny-avila/LibreChat · error · Error

Authentication failed: ${error.message}

Error message

Authentication failed: ${error.message}

What it means

Thrown by the Action executor when setAuth fails for any reason other than a missing or expired access token (those are re-thrown unchanged so the caller can trigger a re-login). All other auth-setup failures are normalized to 'Authentication failed: <reason>'.

Source

Thrown at api/server/services/ActionService.js:380

                metadata.oauth_token_expires_at = expiresAt.toISOString();
              } catch (error) {
                logger.error('Failed to refresh token, requesting new login:', error);
                await requestLogin();
              }
            } else {
              await requestLogin();
            }
          }

          await preparedExecutor.setAuth(metadata);
        } catch (error) {
          if (
            error.message.includes('No access token found') ||
            error.message.includes('Access token is expired')
          ) {
            throw error;
          }
          throw new Error(`Authentication failed: ${error.message}`);
        }
      }

      const response = await preparedExecutor.execute(ssrfAgents);

      if (typeof response.data === 'object') {
        return JSON.stringify(response.data);
      }
      return response.data;
    } catch (error) {
      const message = `API call to ${action.metadata.domain} failed:`;
      return logAxiosError({ message, error });
    }
  };

  if (name) {
    return tool(_call, {
      name: name.replace(replaceSeparatorRegex, '_'),

View on GitHub (pinned to 5ff282f900)

Solutions

Inspect the wrapped error.message (it is included) to find the underlying cause.
Re-configure the action's authentication (re-enter credentials / re-run OAuth).
If encryption keys were rotated, re-encrypt or re-enter stored secrets.
Delete and recreate the action if its metadata is irrecoverably stale.

Defensive patterns

Strategy: try-catch

Type guard

function isMissingOrExpiredTokenError(e) {
  const m = e?.message ?? '';
  return m.includes('No access token found') || m.includes('Access token is expired');
}

Try / catch

try { await preparedExecutor.setAuth(metadata); }
catch (e) {
  if (isMissingOrExpiredTokenError(e)) { await requestLogin(); throw e; }
  throw new Error(`Authentication failed: ${e.message}`);
}

Prevention

Normalize auth errors at the boundary so only known types propagate.
Validate action metadata shape before setAuth.
Re-encrypt stored secrets after key rotations.

When it happens

Trigger: preparedExecutor.setAuth rejects with an error whose message is neither 'No access token found' nor 'Access token is expired' — e.g. malformed metadata, a signing/encryption error, or an unexpected auth scheme mismatch.

Common situations: Corrupted action metadata after a partial migration; an action whose auth type changed but whose stored metadata is stale; encryption key rotation breaking stored secret decryption.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of danny-avila/LibreChat@5ff282f900 (2026-08-12). Data as JSON: /api/errors/5058376fe443e213. Report an issue: GitHub.