paperclipai/paperclip · error · HttpError

skill_authentication_required

skill_authentication_required

Error message

Authentication required

What it means

Auth guard in assertSkillPolicyCompanyAccess: req.actor.type is 'none', i.e. the request carries no authenticated actor. Skill-policy mutations require at least an authenticated identity, so an HttpError(401) with code skill_authentication_required is thrown before any policy read/write.

Source

Thrown at server/src/routes/company-skill-policy.ts:35

      try {
        req.body = schema.parse(req.body);
        next();
      } catch (error) {
        if (error instanceof ZodError) {
          next(unprocessable("Invalid skill policy document", {
            code: "skill_policy_validation_failed",
            issues: error.issues,
          }));
          return;
        }
        next(error);
      }
    };
  }

  function assertSkillPolicyCompanyAccess(req: Request, companyId: string) {
    if (req.actor.type === "none") {
      throw new HttpError(401, "Authentication required", { code: "skill_authentication_required" });
    }
    if (req.actor.type === "agent" && req.actor.companyId !== companyId) {
      throw forbidden("Agent key cannot access another company", { code: "skill_company_boundary_denied" });
    }
    assertCompanyAccess(req, companyId);
  }

  async function assertCanAdministerPolicy(req: Request, companyId: string) {
    assertSkillPolicyCompanyAccess(req, companyId);
    if (req.actor.type === "board") {
      if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) return;
      if (await access.canUser(companyId, req.actor.userId, "users:manage_permissions")) return;
    } else if (
      req.actor.type === "agent"
      && req.actor.agentId
      && await access.hasPermission(companyId, "agent", req.actor.agentId, "users:manage_permissions")
    ) {
      return;

View on GitHub (pinned to 120ae5428f)

Solutions

1. Authenticate (board session or valid agent API key) before calling this endpoint.

When it happens

Trigger: Thrown at server/src/routes/company-skill-policy.ts:35 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/ad2257514fed94f1. Report an issue: GitHub.