What causes "Unauthorized, you must be logged in to make this request." in payloadcms/payload?

Ensure the request is authenticated (`req.user` set) before calling update.

payloadcms/payload · error · UnauthorizedError

Unauthorized, you must be logged in to make this request.

Error message

Unauthorized, you must be logged in to make this request.

What it means

Thrown by the preferences `update` operation when `req.user` is falsy. Like delete, preferences updates are scoped to the authenticated user (the where clause uses `user.value`/`user.relationTo`), so an anonymous request cannot target a preference row.

Source

Thrown at packages/payload/src/preferences/operations/update.ts:17

import type { Where } from '../../types/index.js'
import type { PreferenceUpdateRequest } from '../types.js'

import { UnauthorizedError } from '../../errors/UnauthorizedError.js'
import { preferencesCollectionSlug } from '../config.js'

export async function update(args: PreferenceUpdateRequest) {
  const {
    key,
    req: { payload },
    req,
    user,
    value,
  } = args

  if (!user) {
    throw new UnauthorizedError(req.t)
  }

  const where: Where = {
    and: [
      { key: { equals: key } },
      { 'user.value': { equals: user.id } },
      { 'user.relationTo': { equals: user.collection } },
    ],
  }

  const preference = {
    key,
    user: {
      relationTo: user.collection,
      value: user.id,
    },
    value,
  }

View on GitHub (pinned to 00c58b35c0)

Solutions

Ensure the request is authenticated (`req.user` set) before calling update.
Forward an authenticated `req` when using the Local API.
Guard the UI action behind a logged-in check so the call is never made anonymously.

Example fix

// before
await payload.update({ collection: 'payload-preferences', id, data: { value }, req })

// after
if (!req.user) throw new Error('login required')
await payload.update({ collection: 'payload-preferences', id, data: { value }, req })

Defensive patterns

Strategy: validation

Validate before calling

if (!req.user) {
  return res.status(401).json({ error: 'Authentication required' })
}

await payload.update({
  collection: 'payload-preferences',
  id,
  data: { value },
  req,
})

Type guard

import type { PayloadRequest, User } from 'payload'

function isAuthenticated(req: PayloadRequest): req is PayloadRequest & { user: User } {
  return Boolean(req.user)
}

if (!isAuthenticated(req)) throw new UnauthorizedError(req.t)

Try / catch

try {
  await payload.update({ collection: 'payload-preferences', id, data: { value }, req })
} catch (err) {
  if (err.statusCode === 401) {
    // redirect to login / return 401
  } else throw err
}

Prevention

Ensure the session is established before issuing preference save calls.
Forward the authenticated `req` in Local API calls.
UI: disable preference controls until the user is logged in.

When it happens

Trigger: Calling the preferences update endpoint or `payload.update({ collection: 'payload-preferences', ... })` on a request with no authenticated user.

Common situations: Frontend preference save fired before login completed; server-side update without forwarding the user/session; middleware stripping auth before the preferences route.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/ca14eb254c263611. Report an issue: GitHub.