passbolt/passbolt_api · error · ForbiddenException

The authentication token is not active.

Error message

The authentication token is not active.

What it means

Authorization/state check in TransfersUpdateService::assertOperationIsAllowed() (invoked by update()): a user may only update a transfer they own via an authentication token that belongs to them and is still in an active (non-expired, non-completed) state. This error fires when the transfer's authentication token entity exists but is no longer active — typically an expired or already-consumed token — so the transfer resume/continuation is refused with HTTP 403 and the client must start a new transfer or re-request a token.

Solutions

1. Generate a fresh active token by restarting the mobile transfer setup
2. Check authentication_tokens.active = 1 for the token in use
3. Avoid caching tokens across transfer sessions; fetch the token each flow

const token = transfer.authenticationToken;
if (token && token.active !== true) {
  // token inactive: request a fresh one via transfer setup
  await restartTransferSetup();
}

try {
  await api.updateTransfer(transferId, payload);
} catch (e) {
  if (e.code === 403 && e.message.includes('token is not active')) {
    await restartTransferSetup(); // get a new active token
  }
}

When it happens

Trigger: Updating a transfer after its token was deactivated — e.g. after a previous transfer completed, after calling the token's delete/inactivate endpoint, or when the mobile client retries with an old token.

Common situations: Client caching an old token across transfer restarts; duplicate transfer attempts where the second consumed the token; server-side tests reusing fixtures with inactive tokens.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The authentication token is expired.
• The authentication token is missing.
• The authentication token is not valid for this user.
• The authentication token type is invalid.
• This operation is not allowed for this user.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/3c6c52ed00f80c33. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Mobile/src/Service/Transfers/TransfersUpdateService.php:173

     * - Authentication token is expired
     * @return void
     */
    private function assertOperationIsAllowed(Transfer $transfer, UserAccessControl $uac): void
    {
        if ($transfer->user_id !== $uac->getId()) {
            throw new ForbiddenException(__('This operation is not allowed for this user.'));
        }
        if (!isset($transfer->authentication_token)) {
            throw new ForbiddenException(__('The authentication token is missing.'));
        }
        if ($transfer->authentication_token->user_id !== $uac->getId()) {
            throw new ForbiddenException(__('The authentication token is not valid for this user.'));
        }
        if ($transfer->authentication_token->type !== AuthenticationToken::TYPE_MOBILE_TRANSFER) {
            throw new ForbiddenException(__('The authentication token type is invalid.'));
        }
        if ($transfer->authentication_token->active !== true) {
            throw new ForbiddenException(__('The authentication token is not active.'));
        }
        if ($transfer->authentication_token->isExpired()) {
            throw new ForbiddenException(__('The authentication token is expired.'));
        }
    }

    /**
     * Return an updated transfer entity.
     *
     * @param \Passbolt\Mobile\Model\Entity\Transfer $transfer entity
     * @param array $data data
     * @return \Passbolt\Mobile\Model\Entity\Transfer
     */
    private function patchTransferEntity(Transfer $transfer, array $data): Transfer
    {
        $data['total_pages'] = $transfer->total_pages;

        return $this->Transfers->patchEntity($transfer, $data, [

View on GitHub (pinned to 31c1bbc10f)