payloadcms/payload · critical · InvalidConfiguration

${sanitizedConfig.admin!.user} is not a valid admin user col

Error message

${sanitizedConfig.admin!.user} is not a valid admin user collection

What it means

Thrown at sanitize time when `admin.user` (the collection slug used for admin authentication) does not match any collection, or the matched collection lacks an `auth` configuration. Payload requires exactly one auth-enabled collection to back the admin panel login. Sanitize auto-picks a default users collection if none is set, but if you explicitly set `admin.user` to a slug that is missing or non-auth, it fails.

Source

Thrown at packages/payload/src/config/sanitize.ts:77

  }
  // add default user collection if none provided
  if (!sanitizedConfig?.admin?.user) {
    const firstCollectionWithAuth = sanitizedConfig.collections!.find(({ auth }) => Boolean(auth))

    if (firstCollectionWithAuth) {
      sanitizedConfig.admin!.user = firstCollectionWithAuth.slug
    } else {
      sanitizedConfig.admin!.user = defaultUserCollection.slug
      sanitizedConfig.collections!.push(defaultUserCollection)
    }
  }

  const userCollection = sanitizedConfig.collections!.find(
    ({ slug }) => slug === sanitizedConfig.admin!.user,
  )

  if (!userCollection || !userCollection.auth) {
    throw new InvalidConfiguration(
      `${sanitizedConfig.admin!.user} is not a valid admin user collection`,
    )
  }

  if (sanitizedConfig?.admin?.timezones) {
    if (typeof configToSanitize?.admin?.timezones?.supportedTimezones === 'function') {
      sanitizedConfig.admin.timezones.supportedTimezones =
        configToSanitize.admin.timezones.supportedTimezones({ defaultTimezones })
    }

    if (!sanitizedConfig?.admin?.timezones?.supportedTimezones) {
      sanitizedConfig.admin.timezones.supportedTimezones = defaultTimezones
    }
  } else {
    sanitizedConfig.admin!.timezones = {
      supportedTimezones: defaultTimezones,
    }
  }

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Set `admin.user` to the slug of a collection that has `auth: true`.
2. Re-add `auth: true` to the referenced collection.
3. If you removed all auth collections, omit `admin.user` so Payload injects a default `users` collection.

Example fix

// before
buildConfig({ admin: { user: 'users' }, collections: [{ slug: 'members', auth: true, fields: [] }] })
// after
buildConfig({ admin: { user: 'members' }, collections: [{ slug: 'members', auth: true, fields: [] }] })

const slug = config.admin?.user ?? 'users'
const col = config.collections?.find((c) => c.slug === slug)
if (!col || !col.auth) {
  throw new Error(`admin.user '${slug}' must reference an auth-enabled collection`)
}

function isAdminUserValid(collections: { slug: string; auth?: boolean }[], user?: string): boolean {
  const slug = user ?? 'users'
  return collections.some((c) => c.slug === slug && Boolean(c.auth))
}

When it happens

Trigger: Renaming the users collection without updating `admin.user`; removing `auth: true` from the collection referenced by `admin.user`; setting `admin.user` to a typo'd slug; deleting the users collection entirely.

Common situations: Refactoring auth into a custom users collection (e.g. `members`) and forgetting `admin.user = 'members'`; disabling auth on the users collection for a public-only setup; a plugin that removes the default users collection.

Related errors

• `jobs.processingLease.safetyBuffer` must be non-negative and
• Collection slug already in use: "${config.collections![i]!.s
• error:notAllowedToPerformAction
• error:notAllowedToPerformAction
• error:notAllowedToPerformAction

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/725b4d0f82fbe0d4. Report an issue: GitHub.