passbolt/passbolt_api · error · BadRequestException

An authentication token should be provided.

Error message

An authentication token should be provided.

What it means

Payload guard in AbstractCompleteService::getAndAssertToken: the request data contains no authentication_token.token entry (legacy authenticationtoken spelling also handled), so setup/recovery completion cannot proceed and a 400 is raised.

Solutions

1. Include authentication_token.token in the request body
2. Use the browser extension flow which sends the token

When it happens

Trigger: Thrown at src/Service/Setup/AbstractCompleteService.php:95 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7456166bf451ae02. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Setup/AbstractCompleteService.php:95

     * Return the authentication from data if any
     *
     * @param string $userId the user uuid the token belongs to
     * @param string $tokenType AuthenticationToken::TYPE_*
     * @throws \Cake\Http\Exception\BadRequestException if no authentication token was provided
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is not a uuid
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is expired or invalid
     * @return \App\Model\Entity\AuthenticationToken
     */
    protected function getAndAssertToken(string $userId, string $tokenType): AuthenticationToken
    {
        $data = $this->request->getData();

        // @deprecated since v3.6
        if (isset($data['authenticationtoken'])) {
            $data['authentication_token'] = $data['authenticationtoken'];
        }
        if (!isset($data['authentication_token']) || !isset($data['authentication_token']['token'])) {
            throw new BadRequestException(__('An authentication token should be provided.'));
        }
        $token = $data['authentication_token']['token'];
        if (!Validation::uuid($token)) {
            throw new BadRequestException(__('The authentication token should be a valid UUID.'));
        }
        try {
            return (new AuthenticationTokenGetService())->getActiveNotExpiredOrFail($token, $userId, $tokenType);
        } catch (NotFoundException $exception) {
            throw new BadRequestException(__('The authentication token is not valid.'));
        }
    }

    /**
     * Atomically consume a Setup/Recover token; loser of a concurrent race
     * throws the same `CustomValidationException` shape as `getActiveOrFail`.
     *
     * @param \App\Model\Entity\AuthenticationToken $token token entity previously fetched via `getAndAssertToken`
     * @return void

View on GitHub (pinned to 31c1bbc10f)