passbolt/passbolt_api · error · BadRequestException

The authentication token is not valid.

Error message

The authentication token is not valid.

What it means

The setup start/complete flow looks up an active, non-expired AuthenticationToken of type REGISTER matching the supplied token and user; if none is found a BadRequestException with this message is thrown. The token is the single-use secret proving the invited user's identity.

Solutions

1. Ask an admin to resend the invitation to generate a fresh registration token
2. Verify the token UUID is complete and paired with the correct userId
3. Check authentication_tokens table: the row must be active=true, not expired, type=register for this user
4. Do not re-submit setup after a successful completion; log in instead

use Cake\Validation\Validation;
$tokenValid = Validation::uuid($token)
    && $this->AuthenticationTokens->exists([
        'token' => $token, 'user_id' => $userId,
        'type' => AuthenticationToken::TYPE_REGISTER, 'active' => true,
    ])
    // plus not expired

try {
    $info = $setupStartUserInfoService->getInfo($userId, $token, $data);
} catch (\Cake\Http\Exception\BadRequestException $e) {
    if (str_contains($e->getMessage(), 'authentication token')) {
        // prompt user to request a new invitation email
    }
}

When it happens

Trigger: GET/POST setup endpoints with a token that is expired, already consumed by a previous completion, of the wrong type, belonging to another user, or not a registered token at all.

Common situations: Reusing a setup link after it was completed once; waiting too long so the token expired; copying the token from an old email; self-registration tokens mixed up with recover (RECOVER) tokens.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The user does not exist, is already active or has been…
• The user does not exist or is already active or is disabled.
• This authentication provider is already setup. Disable it…
• Account recovery is disabled. Key backup is not supported.
• Account recovery is mandatory. Please provide the mandatory…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/c9c98da6e76e4375. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Setup/SetupStartUserInfoService.php:61

        return $data;
    }

    /**
     * Check the setup token
     *
     * @param \App\Model\Entity\User $user user attempting to recover
     * @param string $token uuid of the token
     * @throw BadRequestException if the token is not valid
     * @return void
     */
    private function assertAuthToken(User $user, string $token): void
    {
        try {
            (new AuthenticationTokenGetService())
                ->getActiveNotExpiredOrFail($token, $user->id, AuthenticationToken::TYPE_REGISTER);
        } catch (NotFoundException $exception) {
            throw new BadRequestException(__('The authentication token is not valid.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)