invoke-ai/InvokeAI · error · HTTPException

Not authorized to access this image

Error message

Not authorized to access this image

What it means

`assert_image_read_access` raises this 403 when a non-admin user may not view an image: they are not the owner and the image's board is not Shared or Public. It fires only after confirming the image still exists (a missing image yields 404 instead).

Source

Thrown at invokeai/app/api/routers/_access.py:112

    owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)
    if owner is not None and owner == current_user.user_id:
        return

    board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)
    if board_id is not None:
        # See `assert_image_owner` for why this reads the board record and catches only
        # not-found: a lookup that cannot be decided must not present as a permission decision.
        try:
            board = ApiDependencies.invoker.services.board_records.get(board_id)
        except BoardRecordNotFoundException:
            pass
        else:
            if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):
                return

    _assert_image_record_exists(image_name)
    raise HTTPException(status_code=403, detail="Not authorized to access this image")


def assert_board_read_access(board_id: str, current_user: CurrentUserOrDefault) -> None:
    """Raise 403 if the current user may not read images from this board.

    Access is granted when ANY of these hold:
    - The user is an admin.
    - The user owns the board.
    - The board visibility is Shared or Public.
    """
    if current_user.is_admin:
        return

    try:
        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Ask the image owner to move the image to a Shared or Public board
2. Have an admin fetch the image or grant your account ownership/admin rights
3. If you own the board containing the image, flip the board to Shared/Public via PATCH /v1/boards/{board_id}
4. Verify you are authenticated with the intended account (token may belong to a different user than expected)

Example fix

// before
await fetch(`/v1/images/i/${foreignImageName}`); // 403 on private board
// after
await fetch(`/v1/boards/${boardId}`, { method: 'PATCH', body: JSON.stringify({ board_visibility: 'shared' }) });
await fetch(`/v1/images/i/${foreignImageName}`);

// Verify board visibility before sharing image references across users
const board = await fetch(`/v1/boards/${boardId}`, {headers: authHeaders}).then(r => r.json());
if (!['shared','public'].includes(board.board_visibility)) console.warn('Board is private; other users cannot read its images');

function canReadImage(image, user, board) {
  return user.is_admin || image.user_id === user.user_id ||
    (board && ['shared','public'].includes(board.board_visibility));
}

try {
  const img = await fetch(`/v1/images/i/${imageName}`, {headers: authHeaders});
  if (img.status === 403) throw new ForbiddenError();
  return await img.json();
} catch (e) {
  if (e instanceof ForbiddenError) showAccessDeniedNotice(imageName); // request Shared/Public board
  else throw e;
}

When it happens

Trigger: GET on any image-read endpoint (/v1/images/i/{image_name}, thumbnails, metadata, upload URLs) where the user is not admin, does not own the image row, and the image's board visibility is Private (or its board is missing), in multiuser mode.

Common situations: Another user's private-board image linked into your workflow; a shared URL opened by a different account; board visibility changed from Shared back to Private, breaking previously working references.

Related errors

• Not authorized to modify this image
• Not authorized to access this board
• Image not found
• Administrator account already configured
• str(e)

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/f814e29545c20d59. Report an issue: GitHub.