passbolt/passbolt_api · error · RecordNotFoundException

The authentication token does not exist.

Error message

The authentication token does not exist.

What it means

A RecordNotFoundException (with code 400) re-thrown by getOrFail when no active SSO authentication token row matches the given token value, type, and optional user_id. The underlying firstOrFail() raised Cake's RecordNotFoundException, which is wrapped with this domain-specific message.

Solutions

1. Verify the token value and that the correct token TYPE constant is being passed (e.g. SsoAuthenticationToken::TYPE_SSO)
2. Check the sso_authentication_tokens table directly: SELECT * WHERE token = '...' — confirm the row exists and active = 1
3. If the token was consumed, restart the SSO flow to generate a fresh token instead of reusing it
4. Confirm the app points at the expected database/environment where the token was created
5. If a user_id is passed, confirm it matches the token's user_id or omit it

Example fix

// before
$tokenEntity = $service->getOrFail($tokenFromUrl, 'sso.register'); // wrong type
// after
$tokenEntity = (new SsoAuthenticationTokenGetService())
    ->getActiveNotExpiredOrFail($tokenFromUrl, SsoAuthenticationToken::TYPE_SSO);

$exists = $this->fetchTable('Passbolt/Sso.SsoAuthenticationTokens')
    ->exists(['token' => $token, 'type' => $type, 'active' => true]);

try {
    $tokenEntity = $service->getOrFail($token, $type, $userId);
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    // restart SSO flow / issue a new token
}

When it happens

Trigger: getOrFail/finds no row in sso_authentication_tokens where token = $token AND type = $type AND active = true (AND user_id = $userId if provided). Happens with a mistyped token, a wrong token type constant, a token already consumed (active = false), a user_id filter that doesn't match, or a token from another environment/database.

Common situations: Replaying a token after a previous SSO login already consumed it; browser retry after token deletion by cleanup/cron; staging vs production database mixups; client sending the verify token type when a register/recover type is stored; case or whitespace differences in the token string.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• It is not possible to create an authentication token for…
• Record not found in table "sso_auth_tokens"
• The authentication token does not exist or has been deleted.
• The authentication token does not exist or has been deleted.
• The authentication token does not exist or has been deleted.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/3906a35640671006. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php:83

        }
        if (isset($userId) && !Validation::uuid($userId)) {
            throw new BadRequestException(__('The user id should be a valid UUID.'));
        }

        try {
            $where = [
                'token' => $token,
                'type' => $type,
                'active' => true,
            ];
            if (isset($userId)) {
                $where['user_id'] = $userId;
            }

            /** @var \Passbolt\Sso\Model\Entity\SsoAuthenticationToken $tokenEntity */
            $tokenEntity = $this->SsoAuthenticationTokens->find()->where($where)->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new RecordNotFoundException(__('The authentication token does not exist.'), 400, $exception);
        }

        return $tokenEntity;
    }

    /**
     * Get active and not expired token or fail
     *
     * @param string $token Token value.
     * @param string $type Type of token.
     * @return \Passbolt\Sso\Model\Entity\SsoAuthenticationToken
     * @throws \Cake\Http\Exception\NotFoundException If token is not found or inactive
     * @throws \App\Error\Exception\CustomValidationException If the token is expired
     * @throws \Cake\Http\Exception\BadRequestException If token id is not a valid uuid
     */
    public function getActiveNotExpiredOrFail(string $token, string $type): SsoAuthenticationToken
    {
        $ssoAuthToken = $this->getOrFail($token, $type);

View on GitHub (pinned to 31c1bbc10f)