home-assistant/core · error · ValueError

User is not active

Error message

User is not active

What it means

Thrown by AuthManager.async_create_refresh_token (homeassistant/auth/__init__.py:463) when the user is not active (deactivated or the instance is in the 3-hour post-startup window where users default to inactive before onboarding completes). No refresh token may be minted for an inactive user.

Source

Thrown at homeassistant/auth/__init__.py:463

        modules: dict[str, str] = OrderedDict()
        for module_id, module in self._mfa_modules.items():
            if await module.async_is_user_setup(user.id):
                modules[module_id] = module.name
        return modules

    async def async_create_refresh_token(
        self,
        user: models.User,
        client_id: str | None = None,
        client_name: str | None = None,
        client_icon: str | None = None,
        token_type: str | None = None,
        access_token_expiration: timedelta = ACCESS_TOKEN_EXPIRATION,
        credential: models.Credentials | None = None,
    ) -> models.RefreshToken:
        """Create a new refresh token for a user."""
        if not user.is_active:
            raise ValueError("User is not active")

        if user.system_generated and client_id is not None:
            raise ValueError(
                "System generated users cannot have refresh tokens connected "
                "to a client."
            )

        if token_type is None:
            if user.system_generated:
                token_type = models.TOKEN_TYPE_SYSTEM
            else:
                token_type = models.TOKEN_TYPE_NORMAL

        if token_type is models.TOKEN_TYPE_NORMAL:
            expire_at = time.time() + REFRESH_TOKEN_EXPIRATION
        else:
            expire_at = None

View on GitHub (pinned to 58a3fdb3ea)

Solutions

1. Check `user.is_active` before calling and reject/return early in the caller
2. If the user was deactivated unintentionally, reactivate with hass.auth.async_activate_user first, then create the token
3. For fresh instances, wait for onboarding (EVENT_HOMEASSISTANT_STARTED / onboarding done) before creating tokens

Example fix

// before
refresh_token = await hass.auth.async_create_refresh_token(user, client_id)

# after
if not user.is_active:
    raise or return early
refresh_token = await hass.auth.async_create_refresh_token(user, client_id)

if user.is_active:
    refresh_token = await hass.auth.async_create_refresh_token(user, client_id)

def can_mint_token(user) -> bool:
    return user.is_active

When it happens

Trigger: Calling async_create_refresh_token for a user deactivated via async_deactivate_user; calling it during startup before onboarding finished (new instances mark all users inactive until owner is created); long-lived token creation on a deactivated account.

Common situations: Custom auth scripts that don't check user.is_active; attempts to mint tokens for a deprovisioned user; test setup calling token creation against a mock user with is_active=False.

Related errors

• System generated users cannot have refresh tokens connected
• System generated users can only have system type refresh tok
• Client is required to generate a refresh token.
• Client_name is required for long-lived access token
• {client_name} already exists

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/5eecac8616f6e523. Report an issue: GitHub.