invoke-ai/InvokeAI · error · HTTPException

Invalid or expired token

Error message

Invalid or expired token

What it means

unpack_uint5 in sdnq/utils.py requires the packed tensor to have its final dimension equal to 5 (five 32-bit lanes each holding 25 uint5 values plus padding) and at least 2 dims. The library throws this ValueError when given a tensor whose packing layout differs, since bitwise shifts/cats assume exactly the 5-wide last axis.

Source

Thrown at invokeai/app/api/auth_dependencies.py:76

    #
    # Single-user mode, where everything legitimately runs as `system`, never reaches here:
    # its dependencies synthesize the TokenData and return before resolving anything (see
    # `get_current_user_or_default`, `get_current_media_user_or_default`, and
    # `_identify_video_upload_user`). So this refuses only real, minted tokens.
    if token_data.user_id == SYSTEM_USER_ID:
        return None
    user = ApiDependencies.invoker.services.users.get(token_data.user_id)
    if user is None or not user.is_active:
        return None
    if token_data.token_epoch != user.token_epoch:
        return None
    return user


def _validate_token(token: str, invalid_detail: str) -> TokenData:
    token_data = verify_token(token)
    if token_data is None:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=invalid_detail)

    user = resolve_authorized_user(token_data)
    if user is None:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found or inactive")
    return _db_derived_token_data(token_data, user)


def _db_derived_token_data(token_data: TokenData, user: "UserDTO") -> TokenData:
    """Build TokenData whose authorization fields come from the database record.

    The JWT proves *identity* only. Authorization (``is_admin``) must reflect the
    current database state on every request; otherwise a demoted administrator
    keeps admin rights until their token expires — and sliding-window refresh
    would renew that stale claim indefinitely. A promoted user symmetrically
    gains admin rights on their next request without re-login.

    The epoch is carried through from the record so a refreshed token stays valid
    (callers only reach here once ``_token_epoch_is_current`` has passed).

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Ensure the tensor was produced by the matching pack_uint5 so last dim == 5 (numel*8//5 total elements)
2. Add/verify a 2-D view (e.g. packed = packed.view(-1, 5)) before calling unpack_uint5
3. Check the checkpoint's quantization format/version matches the current sdnq code
4. Regenerate the quantized weights with the current InvokeAI quantization script

Example fix

// before
dequant = unpack_uint5(weight_flat.unsqueeze(-1), original_shape)
// after
assert weight.numel() % 5 == 0
packed = weight.view(-1, 5)
dequant = unpack_uint5(packed, original_shape)

def can_unpack_uint5(packed) -> bool:
    return packed.dim() >= 2 and packed.shape[-1] == 5

def is_packed_uint5(t) -> bool:
    import torch
    return isinstance(t, torch.Tensor) and t.dim() >= 2 and t.shape[-1] == 5

try:
    out = unpack_uint5(packed, original_shape)
except ValueError as e:
    if "last dim = 5" in str(e):
        packed = packed.view(-1, 5)
        out = unpack_uint5(packed, original_shape)
    else:
        raise

When it happens

Trigger: Calling unpack_uint5 (directly or via dequantize_int5_per_group) with a tensor whose last dim != 5 (e.g. still-unpacked weights, last dim = 1, 8, or 40), a 1-D tensor (packed.dim() < 2), or a tensor packed by a different/older packing routine with a different lane width.

Common situations: Loading SDNQ checkpoints quantized with a mismatched packer version, manually re-packing or slicing quantized weights before dequantization, or porting int4/int8 packed layouts into the int5 path.

Understand the failure class

Background: Tensor shape mismatch errors ("must have shape", "expected shape ... got ..."): when tensor dimensions disagree with what an op or layer was told to expect — this error's family across 6 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• degrade_sigma must broadcast to [B={batch_size}], got shape
• Operation changed the dtype of GGMLTensor unexpectedly.
• Unexpected keys loading {model_name}: {unexpected}
• Missing keys loading {model_name} (required parameters left
• Operation changed the dtype of SDNQTensor unexpectedly.

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/ae2bf379044cfab0. Report an issue: GitHub.