passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

An authentication token should be provided.

Error message

An authentication token should be provided.

What it means

BadRequestException from getAndAssertToken when no `authentication_token.token` is present in the request data. A recover-type authentication token is mandatory to correlate the recovery request with the user's session.

Solutions

1. Include `authentication_token.token` in the request payload
2. Obtain the token first from the recovery start flow (verify step) and pass it through
3. Fix payload nesting so the token sits under the `authentication_token` key

Example fix

// before
{"user_id": "54c3...", "token": "..."}
// after
{"user_id": "54c3...", "authentication_token": {"token": "..."}}

if (empty($data['authentication_token']['token'])) { throw new \InvalidArgumentException('authentication_token.token is required'); }

null

try { $service->create($data); } catch (BadRequestException $e) { if (str_contains($e->getMessage(), 'token should be provided')) { requestNewToken(); } }

When it happens

Trigger: POST /account-recovery/requests with the `authentication_token.token` key missing or null.

Common situations: Client forgot to include the token obtained from the recover start endpoint; payload nesting flattened incorrectly (`token` at top level instead of under `authentication_token`); an old client version using a different field name.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid request. New key is required for key rotation.
• Invalid request. Revoked key is required for key rotation.
• The authentication token is not valid or has expired.
• Account recovery case must be a string.
• Account recovery is disabled.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d092bb945c1fc403. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestCreateService.php:166

            $msg = __('Recovery request cannot be created when user is not enrolled.');
            throw new BadRequestException($msg);
        }
    }

    /**
     * Return the authentication from data if any
     *
     * @param string $userId the user uuid the token belongs to
     * @throws \Cake\Http\Exception\BadRequestException if no authentication token was provided
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is not a uuid
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is expired or invalid
     * @return \App\Model\Entity\AuthenticationToken
     */
    protected function getAndAssertToken(string $userId): AuthenticationToken
    {
        $token = $this->getData('authentication_token.token');
        if (!isset($token)) {
            throw new BadRequestException(__('An authentication token should be provided.'));
        }

        try {
            $tokenEntity = (new AuthenticationTokenGetService())
                ->getActiveNotExpiredOrFail($token, $userId, AuthenticationToken::TYPE_RECOVER);
        } catch (NotFoundException $exception) {
            throw new BadRequestException(__('The authentication token is not valid or has expired.'));
        }

        // Deactivate all previous active tokens
        $this->AuthenticationTokens->updateQuery()
            ->set(['active' => false])
            ->where([
                'id <>' => $tokenEntity->id,
                'active' => true,
                'type' => AuthenticationToken::TYPE_RECOVER,
                'user_id' => $userId,
            ])

View on GitHub (pinned to 31c1bbc10f)