invoke-ai/InvokeAI · error · HTTPException

Not authorized to access this board

Error message

Not authorized to access this board

What it means

`assert_board_read_access` raises this 403 when the board exists but the current non-admin user may not read its images: they do not own the board and the board visibility is Private (neither Shared nor Public).

Source

Thrown at invokeai/app/api/routers/_access.py:137

    - The user is an admin.
    - The user owns the board.
    - The board visibility is Shared or Public.
    """
    if current_user.is_admin:
        return

    try:
        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")

    if board.user_id == current_user.user_id:
        return

    if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):
        return

    raise HTTPException(status_code=403, detail="Not authorized to access this board")

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Ask the board owner to set the board visibility to 'shared' or 'public' (PATCH /v1/boards/{board_id})
2. Have an admin perform the read or grant your account admin/ownership
3. Use your own board: create a board with POST /v1/boards/ and operate on that board_id
4. Check that you are authenticated as the intended user; switch tokens if a service account is being used unintentionally

Example fix

// before
await fetch(`/v1/board_images/${someoneElsesBoardId}`); // 403
// after
await fetch(`/v1/boards/${someoneElsesBoardId}`, { method: 'PATCH', body: JSON.stringify({ board_visibility: 'shared' }) }); // by board owner
await fetch(`/v1/board_images/${someoneElsesBoardId}`);

const board = await fetch(`/v1/boards/${boardId}`, {headers: authHeaders}).then(r => {
  if (!r.ok) throw new Error('board unavailable'); return r.json();
});
if (board.user_id !== currentUser.user_id && !['shared','public'].includes(board.board_visibility))
  throw new Error(`Board ${boardId} is private to another user`);

function canReadBoard(board, user) {
  return user.is_admin || board.user_id === user.user_id ||
    ['shared','public'].includes(board.board_visibility);
}

try {
  const res = await fetch(`/v1/board_images/${boardId}`, {headers: authHeaders});
  if (res.status === 403) throw new ForbiddenError(boardId);
  return await res.json();
} catch (e) {
  if (e instanceof ForbiddenError) requestBoardAccessFromOwner(e.boardId); // ask owner to set 'shared'
  else throw e;
}

When it happens

Trigger: GET /v1/boards/{board_id} or /v1/board_images/{board_id} in multiuser mode where the board belongs to another user and board.board_visibility is 'private' (default for new boards).

Common situations: Multiuser installations where each user's boards are private by default; a teammate browsing another user's boards; automated scripts using one user's token against another user's board IDs.

Related errors

• Not authorized to access this image
• Not authorized to modify this image
• Board not found
• Administrator account already configured
• str(e)

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/cc883f5a5d2634c8. Report an issue: GitHub.