odoo/odoo · error · AccessError

You do not have permissions to remove the access token

Error message

You do not have permissions to remove the access token

What it means

Access check in res.users.remove_oauth_access_token (auth_oauth): a user may only clear their own oauth_access_token, and only members of base.group_erp_manager may clear someone else's. Any other caller gets AccessError before the sudo() write clears the token.

Source

Thrown at addons/auth_oauth/models/res_users.py:44

    _uniq_users_oauth_provider_oauth_uid = models.Constraint(
        'unique(oauth_provider_id, oauth_uid)',
        'OAuth UID must be unique per provider',
    )

    @property
    def SELF_READABLE_FIELDS(self):
        return super().SELF_READABLE_FIELDS + ['has_oauth_access_token']

    @api.depends('oauth_access_token')
    def _compute_has_oauth_access_token(self):
        for user in self:
            user.has_oauth_access_token = bool(user.sudo().oauth_access_token)

    def remove_oauth_access_token(self):
        user = self.env.user
        if not (user.has_group('base.group_erp_manager') or self == user):
            raise AccessError(self.env._('You do not have permissions to remove the access token'))
        self.sudo().oauth_access_token = False

    def _auth_oauth_rpc(self, endpoint, access_token):
        if self.env['ir.config_parameter'].sudo().get_param('auth_oauth.authorization_header'):
            response = requests.get(endpoint, headers={'Authorization': 'Bearer %s' % access_token}, timeout=10)
        else:
            response = requests.get(endpoint, params={'access_token': access_token}, timeout=10)

        if response.ok: # nb: could be a successful failure
            return response.json()

        auth_challenge = parse_auth(response.headers.get("WWW-Authenticate"))
        if auth_challenge and auth_challenge.type == 'bearer' and 'error' in auth_challenge:
            return dict(auth_challenge)

        return {'error': 'invalid_request'}

    @api.model

View on GitHub (pinned to 1e661df964)

Solutions

1. Restrict UI/RPC exposure of this button to self or group_erp_manager members
2. Run the operation as a user in base.group_erp_manager when admin action is intended
3. Guard before calling: check record == env.user or user.has_group('base.group_erp_manager')

Example fix

// before
env['res.users'].browse(other_user_id).remove_oauth_access_token()  # AccessError
// after
if env.user.has_group('base.group_erp_manager') or other_user_id == env.user.id:
    env['res.users'].browse(other_user_id).remove_oauth_access_token()

if not (user.has_group('base.group_erp_manager') or record == user):
    raise AccessError(env._('You do not have permissions to remove the access token'))

def can_remove_token(env, target_user) -> bool:
    return target_user == env.user or env.user.has_group('base.group_erp_manager')

try:
    target.remove_oauth_access_token()
except AccessError:
    # run as manager or restrict UI to self-service only
    raise

When it happens

Trigger: Calling remove_oauth_access_token on a res.users record that is neither the current env.user nor is the caller in the Administrator/erp_manager group — e.g. a regular user RPC-calling the method on a colleague's id.

Common situations: Custom profile screens exposing token removal for other users without elevation; RPC/XML-RPC scripts acting on arbitrary user ids; testing token removal with a non-admin session.

Related errors

• This page is only accessible to %s users.
• Signup is not allowed for uninvited users
• throw new Error({json.dumps(str(e))});
• Error while creating XML:\n- %s
• You cannot have a receivable/payable account that is not rec

AI-assisted analysis of odoo/odoo@1e661df964 (2026-08-15). Data as JSON: /api/errors/db4b959863d2beee. Report an issue: GitHub.