n8n-io/n8n · error · AuthError

401

401

Error message

Unauthorized

What it means

authenticateUserBasedOnToken throws AuthError('Unauthorized') (status 401) when the token is revoked (found in invalidAuthTokenRepository). This is the per-request token revocation gate used by the resolveJwt path before browser-id and MFA checks run.

Source

Thrown at packages/cli/src/auth/auth.service.ts:290

	 *
	 * @returns the authenticated `User` on success
	 * @throws `AuthError('Unauthorized')` if the token is revoked or invalid
	 */
	async validateCookieToken(token: string): Promise<User> {
		const isInvalid = await this.invalidAuthTokenRepository.existsBy({ token });
		if (isInvalid) throw new AuthError('Unauthorized');
		const { user } = await this.validateToken(token);
		return user;
	}

	async authenticateUserBasedOnToken(
		token: string,
		method: string,
		endpoint: string,
		browserId: string | undefined,
	): Promise<User> {
		const isInvalid = await this.invalidAuthTokenRepository.existsBy({ token });
		if (isInvalid) throw new AuthError('Unauthorized');

		const { user, jwtPayload } = await this.validateToken(token);

		this.validateBrowserId(jwtPayload, browserId, endpoint, method);

		await this.checkMfaGate(user, jwtPayload);

		return user;
	}

	/**
	 * Validates an n8n auth cookie (JWT) without request-bound checks (browserId / endpoint / method).
	 *
	 * Use when the cookie was captured at the controller boundary and must be re-validated
	 * later in the execution lifecycle, after the original HTTP request is no longer available.
	 *
	 * @param cookie - The JWT string extracted from the `n8n-auth` browser cookie.
	 */

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Re-authenticate to get a new token; the old one is permanently revoked.
2. If revocation is unexpected, inspect invalid_auth_tokens in the DB to see when/by whom it was revoked.
3. Ensure clients drop the cookie on 401 rather than retrying with the same token.

Example fix

n/a

n/a (revocation table is server-side)

function isAuthError(error: unknown): error is Error {
  return error instanceof Error && error.message === 'Unauthorized';
}

try {
  await authService.authenticateUserBasedOnToken(token, method, endpoint, browserId);
} catch (e) {
  if (e instanceof AuthError) { /* token revoked or failed downstream checks: 401 the client */ }
  else throw e;
}

When it happens

Trigger: A request reaches authenticateUserBasedOnToken with a token that exists in the invalid auth tokens table. The check fires immediately, before JWT verification, browserId binding, or MFA gate evaluation.

Common situations: User logged out but the client kept sending the old cookie; admin force-logged out all sessions; password reset invalidated existing tokens; replay of a captured token after revocation.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• 401
• Models couldn't be loaded. Check that the selected credentia
• OAuth access token expired and no refresh token is available
• ESTATUS
• Set N8N_AI_ANTHROPIC_KEY or ANTHROPIC_API_KEY — the judge LL

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/486925da9bca3aae. Report an issue: GitHub.