passbolt/passbolt_api · error · InternalErrorException

The configuration is not correctly set.

Error message

The configuration {0} is not correctly set.

What it means

The JWT access token expiry configuration (passbolt.auth.token.access_token.expiry) could not be parsed into a valid DateTime interval. JwtTokenCreateService::createExpiryDate builds a '+<period>' string from the configured value and feeds it to DateTime(); any unparseable/empty value throws, and the service converts it into an InternalErrorException (HTTP 500). This is a server-side configuration error, not a client error.

Solutions

1. Set a valid interval string for the config key passbolt.auth.token.access_token.expiry (e.g. '1 month'), matching the format accepted by PHP DateTime('+interval').
2. Check config/passbolt.default.php or the JwtAuthentication plugin config for the default value and ensure your local/env config does not override it with null/empty.
3. Run `passbolt healthcheck` (or bin/cake passbolt healthcheck) to detect misconfigured JWT settings.
4. If passing $expirationPeriod explicitly, validate it parses (new DateTime('+' . $value)) before calling createExpiryDate.

Example fix

// before (config/passbolt.php)
'auth' => ['token' => ['access_token' => ['expiry' => env('JWT_EXPIRY')]]], // env var unset => null
// after
'auth' => ['token' => ['access_token' => ['expiry' => env('JWT_EXPIRY', '1 month')]]],

$expiry = Configure::read('passbolt.auth.token.access_token.expiry');
if (!is_string($expiry) || $expiry === '' || @new DateTime('+' . $expiry) === false) {
    throw new RuntimeException('passbolt.auth.token.access_token.expiry must be a valid interval string, e.g. "1 month"');
}

function isValidIntervalString(mixed $v): bool {
    return is_string($v) && $v !== '' && (function () use ($v) { try { new DateTime('+' . $v); return true; } catch (Throwable) { return false; } })();
}

try {
    $expiry = $service->createExpiryDate();
} catch (InternalErrorException $e) {
    $this->log('JWT expiry config invalid: ' . $e->getPrevious()?->getMessage());
    throw new RuntimeException('Fix passbolt.auth.token.access_token.expiry; see previous exception', 0, $e);
}

When it happens

Trigger: Calling createToken (login/JWT issuance) when passbolt.auth.token.access_token.expiry is missing, set to null, an empty string, or a string that DateTime('+...') cannot parse (e.g. '1 fortnight', 'abc', '4 weeks 3 gibberish'). An explicit $expirationPeriod argument that is malformed triggers the same path.

Common situations: Upgrading passbolt after the config key was renamed/moved and the old config file lacks the new key; a typo when overriding the key in a custom config or environment variable; a deployment template leaving the value blank.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Could not enable Duo MFA provider.
• Could not enable Duo MFA provider.
• Could not login using Duo MFA provider.
• Invalid public key validation rules are missing.
• No default expiry or expiry for token type

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/861c8785ca042461. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwtTokenCreateService.php:73

        ];

        return JWT::encode($payload, $privateKey, self::JWT_ALG);
    }

    /**
     * Create a UNIX time from a time expressed in words.
     * This should return an integer.
     *
     * @param string|null $expirationPeriod Expiration period in words.
     * @return int Unix time
     */
    public function createExpiryDate(?string $expirationPeriod = null): int
    {
        $expiryPeriod = $expirationPeriod ?? Configure::read(JwtTokenCreateService::JWT_EXPIRY_CONFIG_KEY);
        try {
            return (int)(new DateTime('+' . $expiryPeriod))->toUnixString();
        } catch (Throwable $e) {
            throw new InternalErrorException(
                __('The configuration {0} is not correctly set.', JwtTokenCreateService::JWT_EXPIRY_CONFIG_KEY),
                500,
                $e
            );
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)