infiniflow/ragflow · error · Exception

Invalid token authentication

Error message

Invalid token authentication

What it means

Error "Invalid token authentication" thrown in infiniflow/ragflow.

Source

Thrown at api/apps/restful_apis/agent_api.py:2024

                client=REDIS_CONN.REDIS,
            )

            allowed = int(res[0])
            if allowed != 1:
                raise Exception("Too many requests (rate limit exceeded)")

        except Exception as e:
            raise Exception(f"Rate limit error: {e}")

    def _validate_token_auth(security_cfg):
        """Validate header-based token authentication."""
        token_cfg = security_cfg.get("token", {})
        header = token_cfg.get("token_header")
        token_value = token_cfg.get("token_value")

        provided = request.headers.get(header)
        if provided != token_value:
            raise Exception("Invalid token authentication")

    def _validate_basic_auth(security_cfg):
        """Validate HTTP Basic Auth credentials."""
        auth_cfg = security_cfg.get("basic_auth", {})
        username = auth_cfg.get("username")
        password = auth_cfg.get("password")

        auth = request.authorization
        if not auth or auth.username != username or auth.password != password:
            raise Exception("Invalid Basic Auth credentials")

    def _validate_jwt_auth(security_cfg):
        """Validate JWT token in Authorization header."""
        jwt_cfg = security_cfg.get("jwt", {})
        secret = jwt_cfg.get("secret")
        if not secret:
            raise Exception("JWT secret not configured")

View on GitHub (pinned to 554fb1133a)

Solutions

1. Provide a valid webhook token in the request.
2. Regenerate the token in the agent webhook settings if it was rotated.

Example fix

headers = {'X-Webhook-Token': '<valid-token>'}

When it happens

Trigger: Thrown at api/apps/restful_apis/agent_api.py:2024 when the library encounters an invalid state.

Common situations: The webhook request carries a missing, malformed, or outdated token; using the current configured token prevents this error.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/a100ef6d25e7d9db. Report an issue: GitHub.