infiniflow/ragflow · error · Error

Failed to fetch memory list

Error message

Failed to fetch memory list

What it means

Non-HttpError exception during validation whose string form contains MISSING_SCOPES_ERROR_STR (Google's 'Request had insufficient authentication scopes' message). Token authenticates but was minted with a narrower scope than the call needs; raised as InsufficientPermissionsError.

Source

Thrown at web/src/pages/memories/hooks.ts:98

  >({
    queryKey: [
      'memoryList',
      {
        debouncedSearchString,
        ...pagination,
      },
      filterValue,
    ],
    queryFn: async () => {
      const { data: response } = await memoryService.getMemoryList(
        {
          params: requestParams,
          data: { memory_type: memoryType },
        },
        true,
      );
      if (response.code !== 0) {
        throw new Error(response.message || 'Failed to fetch memory list');
      }
      console.log(response);
      return response;
    },
  });

  // const setMemoryListParams = (newParams: MemoryListParams) => {
  //   setMemoryParams((prevParams) => ({
  //     ...prevParams,
  //     ...newParams,
  //   }));
  // };

  return {
    data,
    isLoading,
    isError,
    pagination,

View on GitHub (pinned to 554fb1133a)

Solutions

1. Regenerate the token through the connector's own OAuth flow so all requested scopes are consented
2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a scope list your Workspace admin permits, then re-run the flow
3. For service accounts, ensure domain-wide delegation includes the exact scopes in the error body

Example fix

# before
creds = GoogleCredentials.get_application_default()  # narrow scopes

# after: explicit full scope set
from google_auth_oauthlib.flow import InstalledAppFlow
flow = InstalledAppFlow.from_client_config(cfg, scopes=[
    "https://www.googleapis.com/auth/drive.readonly.metadata",
    "https://www.googleapis.com/auth/admin.directory.user.readonly",
])
creds = flow.run_local_server()

MISSING_SCOPES = "insufficient authentication scopes"

def error_mentions_scopes(exc: Exception) -> bool:
    return MISSING_SCOPES in str(exc)

REQUIRED = {
    "https://www.googleapis.com/auth/drive.readonly.metadata",
    "https://www.googleapis.com/auth/admin.directory.user.readonly",
}

def creds_have_all_scopes(creds) -> bool:
    return REQUIRED <= set(getattr(creds, "scopes", None) or [])

from common.data_source.exceptions import InsufficientPermissionsError

try:
    connector.validate_connector_settings()
except InsufficientPermissionsError as e:
    if "missing required scopes" in str(e):
        connector.load_credentials(reissue_oauth_with_full_scope_consent())
        connector.validate_connector_settings()

When it happens

Trigger: google.auth exceptions carrying the insufficient-scopes reason (raised during credential refresh or the transport layer rather than an HTTP response), tokens created via gcloud auth application-default login (limited scopes), or incremental-consent tokens missing admin-directory scope.

Common situations: Reusing ADC or CLI-generated tokens instead of the connector's OAuth flow, Google changing default scope sets, user granting only some requested scopes in a subset-consent deployment.

Related errors

• message.compileNotSupported
• Failed to fetch memory detail
• Your Dropbox token does not have sufficient permissions.
• Found no repos for organization: {self.repo_owner}. Does the
• Found no repos for user: {self.repo_owner}. Does the credent

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/46e68b37380bab81. Report an issue: GitHub.