gotify/server · error

appid is required when not authenticating with an applicatio

Error message

appid is required when not authenticating with an application token

What it means

CreateMessage throws 400 'appid is required when not authenticating with an application token' when the request is authenticated as a client/user (not an app token) and the message body has no applicationID. Without an app token, Gotify cannot infer which application the message belongs to.

Source

Thrown at api/message.go:372

//	        $ref: "#/definitions/Error"
//	  401:
//	    description: Unauthorized
//	    schema:
//	        $ref: "#/definitions/Error"
//	  403:
//	    description: Forbidden
//	    schema:
//	        $ref: "#/definitions/Error"
func (a *MessageAPI) CreateMessage(ctx *gin.Context) {
	message := model.CreateMessage{}
	if err := ctx.Bind(&message); err != nil {
		return
	}

	app := auth.GetApplication(ctx)
	if app == nil {
		if message.ApplicationID == 0 {
			ctx.AbortWithError(400, errors.New("appid is required when not authenticating with an application token"))
			return
		}
		fetchedApp, err := a.DB.GetApplicationByID(message.ApplicationID)
		if success := successOrAbort(ctx, 500, err); !success {
			return
		}
		if fetchedApp == nil || fetchedApp.UserID != auth.GetUserID(ctx) {
			ctx.AbortWithError(400, errors.New("appid not found"))
			return
		}
		app = fetchedApp
	}

	message.ApplicationID = app.ID
	if strings.TrimSpace(message.Title) == "" {
		message.Title = app.Name
	}

View on GitHub (pinned to 14bfc25627)

Solutions

1. Include "appid": <id> in the request body.
2. Or authenticate with an application token (Authorization: Bearer <app token> or X-Gotify-Key header) so appid can be inferred.
3. Create an application in the Gotify UI to obtain an app token.

Example fix

// before
POST /message {"title":"hi","message":"hello"} // client token, no appid
// after
POST /message {"appid": 3, "title":"hi","message":"hello"}
// or use an app token instead of the client token

if (!authIsAppToken && !(body.appid > 0)) throw new Error('appid is required when not using an application token');

function hasAppId(body) { return typeof body.appid === 'number' && Number.isInteger(body.appid) && body.appid > 0; }

try {
  await gotify.post('/message', body);
} catch (e) {
  if (e.response?.status === 400 && /appid is required/.test(e.response.data)) {
    body.appid = resolvedAppId; // retry with explicit app id
  } else throw e;
}

When it happens

Trigger: POST /message with a client token or basic auth, no 'appid' (or appid: 0) in the JSON body.

Common situations: Reusing a client token meant for reading messages to also send messages; copying examples that use app tokens but authenticating differently; forgetting that appid is only optional when using an application token.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• appid not found
• file must be an image
• invalid file extension
• invalid id
• password must not be empty

AI-assisted analysis of gotify/server@14bfc25627 (2026-09-05). Data as JSON: /api/errors/92d28e92d10181df. Report an issue: GitHub.