invoke-ai/InvokeAI · error · HTTPException

Not authorized to access this board

Error message

Not authorized to access this board

What it means

HTTP 403 returned by GET /boards/{board_id} after the board is found but the access check fails: the requester is not an admin, is not the board's owner, and the board's visibility is Private. This is a multi-user access-control error, not a data-missing error.

Source

Thrown at invokeai/app/api/routers/boards.py:84

    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to get"),
) -> BoardDTO:
    """Gets a board (user must have access to it)"""

    try:
        result = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")

    # Admins can access any board.
    # Owners can access their own boards.
    # Shared and public boards are visible to all authenticated users.
    if (
        not current_user.is_admin
        and result.user_id != current_user.user_id
        and result.board_visibility == BoardVisibility.Private
    ):
        raise HTTPException(status_code=403, detail="Not authorized to access this board")

    return result


@boards_router.patch(
    "/{board_id}",
    operation_id="update_board",
    responses={
        201: {
            "description": "The board was updated successfully",
        },
    },
    status_code=201,
    response_model=BoardDTO,
)
def update_board(
    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to update"),

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Log in as the board owner or an admin account
2. Have the owner change the board's visibility via PATCH /boards/{board_id} (set Shared/Public)
3. Verify you are authenticated as the intended user (check current user endpoint / token)
4. If access should be allowed, confirm the deployment's user setup/roles

Example fix

// before
await api.get(`/boards/${boardId}`);
// after
// owner flips visibility first:
await api.patch(`/boards/${boardId}`, { board_visibility: 'Shared' });
const board = await api.get(`/boards/${boardId}`);

const board = await api.get(`/boards/${boardId}`).catch(() => null); // 403 throws here if private
if (board === null) console.warn('no access to board', boardId);

const isForbidden = (e) => e?.response?.status === 403;

try {
  return await api.get(`/boards/${boardId}`);
} catch (e) {
  if (isForbidden(e)) {
    console.error(`Board ${boardId} is Private and you are not owner/admin`);
    return null;
  }
  throw e;
}

When it happens

Trigger: GET /boards/{board_id} authenticated as a non-admin user who does not own the board and where board DTO has board_visibility == 'Private'.

Common situations: Sharing board URLs between users on a multi-user InvokeAI deployment, token/auth confusion causing requests under the wrong user, or boards created as Private by default.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized to update this board
• Not authorized to delete this board
• Not authorized to access this download
• You do not have permission to delete this queue item
• You do not have permission to cancel this queue item

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/372ac761253c1876. Report an issue: GitHub.