passbolt/passbolt_api · error · Cake\Http\Exception\ValidationException

It is not possible to create an authentication token for…

Error message

It is not possible to create an authentication token for this user.

What it means

AuthenticationTokensTable::generate() builds a new authentication token entity for a user. If entity validation fails (errors present after build), it throws a ValidationException with this generic message instead of exposing field-level errors directly in the message.

Solutions

1. Verify the user id exists and is a valid UUID before calling generate().
2. Check the token type is one of the supported AuthenticationToken types.
3. Inspect getErrors() on the token by calling buildEntity/debug to see the actual field errors.
4. Ensure the user is active/not deleted if your validation rules require it.

Example fix

// before
$token = $this->AuthenticationTokens->generate('not-a-uuid', AuthenticationToken::TYPE_RECOVER);
// after
if (!Validation::uuid($userId)) { throw new BadRequestException('Invalid user id'); }
$token = $this->AuthenticationTokens->generate($userId, AuthenticationToken::TYPE_RECOVER);

use Cake\Validation\Validation;
if (!Validation::uuid($userId)) { throw new InvalidArgumentException('user id must be a UUID'); }
$user = $this->Users->find()->where(['id' => $userId])->first();
if (!$user) { throw new RecordNotFoundException('User not found'); }

function isValidTokenContext(string $userId, string $type, UsersTable $users): bool {
  return Validation::uuid($userId)
    && in_array($type, AuthenticationToken::ALLOWED_TYPES, true)
    && $users->exists(['id' => $userId]);
}

try { $token = $this->AuthenticationTokens->generate($userId, $type); }
catch (ValidationException $e) { $this->log('Token generation rejected for user ' . $userId); throw new BadRequestException('Cannot create token for this user.'); }

When it happens

Trigger: Calling AuthenticationTokensTable::generate($userId, $type) where the built token entity fails validation — most commonly the user_id is not a valid UUID or does not exist, or an invalid token type is passed.

Common situations: Passing a non-existent or deleted user id, generating a token with an unsupported type constant, or calling generate before the user record is committed.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• " " is not a valid search filter.
• " " is not a valid search filter. It is not a UTF8 string.
• " " is not a valid search filter. It should be between 1…
• " " is not a valid user filter.
• " " is not a valid value for filter .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/02f57d4f1d090bf6. Report an issue: GitHub.

Appendix: source

Thrown at src/Model/Table/AuthenticationTokensTable.php:232

            [
                'user_id' => $userId,
                'token' => $token ?? UuidFactory::uuid(),
                'active' => true,
                'type' => $type,
                'data' => empty($data) ? null : json_encode($data),
            ],
            ['accessibleFields' => [
                'user_id' => true,
                'token' => true,
                'active' => true,
                'type' => true,
                'data' => true,
            ]]
        );
        $errors = $token->getErrors();
        $msg = __('It is not possible to create an authentication token for this user.');
        if (!empty($errors)) {
            throw new ValidationException($msg);
        }
        if (!$this->save($token)) {
            throw new ValidationException($msg);
        }

        return $token;
    }

    /**
     * Check if a token exist and is valid for a given user.
     *
     * A valid token :
     *  - belongs to the given user &&
     *  - is active &&
     *  - is not expired ;
     *
     * @param string $token uuid of the token to check
     * @param string $userId uuid of the user

View on GitHub (pinned to 31c1bbc10f)