immich-app/immich · error · ForbiddenException

Not authenticated with an API Key

Error message

Not authenticated with an API Key

What it means

Thrown by ApiKeyService.getMine as a ForbiddenException (HTTP 403) when auth.apiKey is falsy. The endpoint's contract is to return the key currently making the request, which is only meaningful when the caller authenticated with an API key. Session-based (cookie/JWT) callers have no apiKey on the auth context.

Source

Thrown at server/src/services/api-key.service.ts:59

    }

    const key = await this.apiKeyRepository.update(auth.user.id, id, { name: dto.name, permissions: dto.permissions });

    return this.map(key);
  }

  async delete(auth: AuthDto, id: string): Promise<void> {
    const exists = await this.apiKeyRepository.getById(auth.user.id, id);
    if (!exists) {
      throw new BadRequestException('API Key not found');
    }

    await this.apiKeyRepository.delete(auth.user.id, id);
  }

  async getMine(auth: AuthDto): Promise<ApiKeyResponseDto> {
    if (!auth.apiKey) {
      throw new ForbiddenException('Not authenticated with an API Key');
    }

    const key = await this.apiKeyRepository.getById(auth.user.id, auth.apiKey.id);
    if (!key) {
      throw new BadRequestException('API Key not found');
    }

    return this.map(key);
  }

  async getById(auth: AuthDto, id: string): Promise<ApiKeyResponseDto> {
    const key = await this.apiKeyRepository.getById(auth.user.id, id);
    if (!key) {
      throw new BadRequestException('API Key not found');
    }
    return this.map(key);
  }

View on GitHub (pinned to 199723261c)

Solutions

1. Call this endpoint only with API-key authentication (x-api-key header)
2. For session-authenticated callers, use GET /api-keys to list keys instead of /api-keys/me
3. Check the client's auth method before invoking getMine

Example fix

// before
const me = await sdk.getMyApiKey({ sessionCookie }); // 403
// after
const me = await sdk.getMyApiKey({ apiKey: 'sk_...' }); // x-api-key

// Only call /api-keys/me when authenticated with an API key
if (!authMethod || authMethod !== 'x-api-key') {
  // use the list endpoint instead for session auth
  const keys = await sdk.getAllApiKeys();
  return;
}
const me = await sdk.getMyApiKey();

function isApiKeyAuth(auth: { apiKey?: unknown }): auth is { apiKey: { id: string; permissions: string[] } } {
  return !!auth?.apiKey && typeof (auth.apiKey as any).id === 'string';
}

When it happens

Trigger: GET /api-keys/me while authenticated with a web session cookie or a bearer JWT instead of an API key (`x-api-key` header). Any non-API-key auth scheme will trip this.

Common situations: Browser dev tools hitting the endpoint while logged in via session; SDK client initialized with email/password auth instead of an API key; mixing session and key auth in one client.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Cannot grant permissions you do not have
• Missing required permission: ${requestedPermission}
• Elevated permission is required
• Missing JWT Token
• Invalid JWT Token

AI-assisted analysis of immich-app/immich@199723261c (2026-08-12). Data as JSON: /api/errors/3bf4313f20a527c7. Report an issue: GitHub.