immich-app/immich · error · BadRequestException

password is required

Error message

password is required

What it means

Thrown (as BadRequestException) by UserAdminService.create when OAuth is disabled in system config and the supplied UserAdminCreateDto carries no password. Without OAuth as an auth alternative, a newly created user must have a password set, so the create is rejected before the user record is written.

Source

Thrown at server/src/services/user-admin.service.ts:37

import { getCalendarHeatmap } from 'src/services/shared/user-methods';
import { findOrFail } from 'src/utils/misc';
import { getPreferences, getPreferencesPartial, mergePreferences } from 'src/utils/preferences';

@Injectable()
export class UserAdminService extends BaseService {
  async search(auth: AuthDto, dto: UserAdminSearchDto): Promise<UserAdminResponseDto[]> {
    const users = await this.userRepository.getList({
      id: dto.id,
      withDeleted: dto.withDeleted,
    });
    return users.map((user) => mapUserAdmin(user));
  }

  async create(dto: UserAdminCreateDto): Promise<UserAdminResponseDto> {
    const { notify, ...userDto } = dto;
    const config = await this.getConfig({ withCache: false });
    if (!config.oauth.enabled && !userDto.password) {
      throw new BadRequestException('password is required');
    }

    const user = await this.createUser(userDto);

    await this.eventRepository.emit('UserSignup', {
      notify: !!notify,
      id: user.id,
      password: userDto.password,
    });

    return mapUserAdmin(user);
  }

  async get(auth: AuthDto, id: string): Promise<UserAdminResponseDto> {
    const user = await this.findOrFail(id, { withDeleted: true });
    return mapUserAdmin(user);
  }

View on GitHub (pinned to 199723261c)

Solutions

1. Include a non-empty password in the create payload.
2. Enable and fully configure OAuth in System Config, then retry without a password.
3. If migrating from OAuth to password auth, set a temporary password and force a reset.

Example fix

// before
await usersApi.create({ email, name: 'Jane' });
// after
await usersApi.create({ email, name: 'Jane', password: tempPassword });

const config = await configApi.getConfig();
function needsPassword() { return !config.oauth.enabled; }
if (needsPassword() && !dto.password) { /* require password in the form */ }

try { await usersApi.create(dto); }
catch (e) {
  if (e instanceof BadRequestException && e.message === 'password is required') {
    // prompt for a password or enable OAuth in System Config
  }
}

When it happens

Trigger: POST /admin/users with an empty/omitted password field while config.oauth.enabled is false.

Common situations: Admin attempts passwordless invite without having enabled OAuth; frontend invite form skipped the password step; automated provisioning forgot the field.

Related errors

• Error backchannel logout: token validation failed
• Admin status can only be changed by another admin
• Email is not available
• Storage label already in use by another account
• Password login has been disabled

AI-assisted analysis of immich-app/immich@199723261c (2026-08-12). Data as JSON: /api/errors/08589e8ece7e1253. Report an issue: GitHub.