invoke-ai/InvokeAI · error · HTTPException

Not authorized to access this board

Error message

Not authorized to access this board

What it means

HTTP 403 returned by GET /boards/{board_id} after the board is found but the access check fails: the requester is not an admin, is not the board's owner, and the board's visibility is Private. This is a multi-user access-control error, not a data-missing error.

Solutions

1. Log in as the board owner or an admin account
2. Have the owner change the board's visibility via PATCH /boards/{board_id} (set Shared/Public)
3. Verify you are authenticated as the intended user (check current user endpoint / token)
4. If access should be allowed, confirm the deployment's user setup/roles

Example fix

// before
await api.get(`/boards/${boardId}`);
// after
// owner flips visibility first:
await api.patch(`/boards/${boardId}`, { board_visibility: 'Shared' });
const board = await api.get(`/boards/${boardId}`);

const board = await api.get(`/boards/${boardId}`).catch(() => null); // 403 throws here if private
if (board === null) console.warn('no access to board', boardId);

const isForbidden = (e) => e?.response?.status === 403;

try {
  return await api.get(`/boards/${boardId}`);
} catch (e) {
  if (isForbidden(e)) {
    console.error(`Board ${boardId} is Private and you are not owner/admin`);
    return null;
  }
  throw e;
}

When it happens

Trigger: GET /boards/{board_id} authenticated as a non-admin user who does not own the board and where board DTO has board_visibility == 'Private'.

Common situations: Sharing board URLs between users on a multi-user InvokeAI deployment, token/auth confusion causing requests under the wrong user, or boards created as Private by default.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized to update this board
• Not authorized to access this download
• Not authorized to access this style preset
• Not authorized to delete this board
• Not authorized to modify this board

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/372ac761253c1876. Report an issue: GitHub.

Appendix: source

Thrown at invokeai/app/api/routers/boards.py:84

    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to get"),
) -> BoardDTO:
    """Gets a board (user must have access to it)"""

    try:
        result = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")

    # Admins can access any board.
    # Owners can access their own boards.
    # Shared and public boards are visible to all authenticated users.
    if (
        not current_user.is_admin
        and result.user_id != current_user.user_id
        and result.board_visibility == BoardVisibility.Private
    ):
        raise HTTPException(status_code=403, detail="Not authorized to access this board")

    return result


@boards_router.patch(
    "/{board_id}",
    operation_id="update_board",
    responses={
        201: {
            "description": "The board was updated successfully",
        },
    },
    status_code=201,
    response_model=BoardDTO,
)
def update_board(
    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to update"),

View on GitHub (pinned to 0b6a024f2f)