mem0ai/mem0 · error · HTTPException

User not found.

Error message

User not found.

What it means

Raised by POST /auth/refresh when the refresh token is structurally valid and has a jti, but the user id in its `sub` claim no longer matches a row in the database (db.get(User, payload["sub"]) returns None). The token is authentic but refers to a deleted or never-existent account, so the server refuses rotation.

Source

Thrown at server/routers/auth.py:157

        access_token=create_access_token(str(user.id), user.role),
        refresh_token=create_refresh_token(str(user.id), db),
    )


@router.post("/refresh", response_model=TokenResponse)
@limiter.limit("20/minute")
def refresh(request: Request, body: RefreshRequest, db: Session = Depends(get_db)):
    payload = decode_token(body.refresh_token)
    if payload.get("type") != "refresh":
        raise HTTPException(status_code=401, detail="Invalid token type.")

    jti = payload.get("jti")
    if not jti:
        raise HTTPException(status_code=401, detail="Refresh token is no longer valid.")

    user = db.get(User, payload["sub"])
    if user is None:
        raise HTTPException(status_code=401, detail="User not found.")

    consume_refresh_jti(jti, db)

    return TokenResponse(
        access_token=create_access_token(str(user.id), user.role),
        refresh_token=create_refresh_token(str(user.id), db),
    )


@router.get("/me", response_model=UserResponse)
def me(user: User = Depends(require_auth)):
    return user


@router.patch("/me", response_model=UserResponse)
def update_me(
    body: UpdateProfileRequest,
    user: User = Depends(require_auth),

View on GitHub (pinned to 001c235229)

Solutions

1. Confirm the user id in the token's sub claim exists in the users table of the database this server is connected to
2. If the DB was reset or the environment changed, discard stored tokens and log in again
3. If account deletion is expected, make sure the client handles 401 here by clearing session state and redirecting to login

Example fix

// before: keep retrying refresh with a token whose user no longer exists
while (true) { try { await refresh(); break; } catch (e) { /* retry */ } }

// after: treat 401 "User not found." as terminal — clear tokens and re-login
catch (e) {
  if (e.status === 401) { clearStoredTokens(); router.push("/login"); }
}

catch (e) {
  if (e.status === 401 && e.detail === "User not found.") {
    clearStoredTokens();
    redirectToLogin(); // account gone; refresh can never succeed
  }
  throw e;
}

When it happens

Trigger: User account was deleted (hard delete) after the refresh token was issued; token references a user id from a different database/environment (e.g. staging token sent to a fresh local DB); `sub` claim altered to a non-existent id while keeping a valid signature is not possible, so this is almost always deletion or environment mismatch.

Common situations: DB was reset or re-seeded while clients held refresh tokens; account deletion/GDPR purge leaves live tokens; dev pointing the client at the wrong server instance.

Related errors

• Invalid token type.
• Authentication failed. Your API key may be invalid or expire
• Resource not found: ${path}
• Bad request to ${path}: ${detail}
• Either memoryId or --all is required

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/8813d52f6e57c313. Report an issue: GitHub.