flarum/framework · error · Exception

Use of AccessToken::generate() is not allowed: use the…

Error message

Use of AccessToken::generate() is not allowed: use the `generate` method on one of the subclasses.

What it means

Sentinel guard in AccessToken::make: calling make()/generate() directly on the base AccessToken class is forbidden because the base class has no token type (static::$type is undefined for it). Tokens must be created via a concrete subclass (e.g. DeveloperAccessToken, Rememberer) so the 'type' column is set correctly. Calling AccessToken::generate() lands in make() with static::class === AccessToken::class and throws.

Solutions

1. Call generate() on a concrete subclass, e.g. DeveloperAccessToken::generate($userId)
2. Choose the appropriate token subclass for the lifetime/purpose you need
3. Type-hint against the subclass you intend to issue rather than AccessToken

When it happens

Trigger: Thrown at framework/core/src/Http/AccessToken.php:92 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/2a0daaddee984399. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Http/AccessToken.php:92

    private const LAST_ACTIVITY_UPDATE_DIFF = 90;

    public ?array $uniqueKeys = ['token'];

    /**
     * Generate an access token for the specified user.
     */
    public static function generate(int $userId): static
    {
        $token = static::make($userId);
        $token->save();

        return $token;
    }

    public static function make(int $userId): static
    {
        if (static::class === self::class) {
            throw new \Exception('Use of AccessToken::generate() is not allowed: use the `generate` method on one of the subclasses.');
        }

        $token = new static;
        $token->type = static::$type;
        $token->token = Str::random(40);
        $token->user_id = $userId;
        $token->created_at = Carbon::now();
        $token->last_activity_at = Carbon::now();

        return $token;
    }

    /**
     * Update the time of last usage of a token.
     * If a request object is provided, the IP address and User Agent will also be logged.
     */
    public function touch($attribute = null, ?ServerRequestInterface $request = null): bool
    {

View on GitHub (pinned to 4b939f6853)