payloadcms/payload · error · Forbidden

You are not allowed to perform this action.

Error message

You are not allowed to perform this action.

What it means

Thrown by the `runJobs` operation when `overrideAccess` is not false and `jobsConfig.access.run` returns false. Default run access allows logged-in users. This guards the worker that claims and executes queued jobs (it acquires a processing token/lease).

Source

Thrown at packages/payload/src/queues/operations/runJobs/index.ts:112

    req: {
      payload,
      payload: {
        config: { jobs: jobsConfig },
      },
    },
    sequential,
    silent = false,
    where: whereFromProps,
  } = args

  if (!overrideAccess) {
    /**
     * By default, jobsConfig.access.run will be `defaultAccess` which is a function that returns `true` if the user is logged in.
     */
    const accessFn = jobsConfig?.access?.run ?? (() => true)
    const hasAccess = await accessFn({ req })
    if (!hasAccess) {
      throw new Forbidden(req.t)
    }
  }
  const now = getCurrentDate()
  const { duration: processingLeaseDuration, safetyBuffer: processingLeaseSafetyBuffer } =
    jobsConfig.processingLease
  const nowISOString = now.toISOString()
  const processingUntil = new Date(now.getTime() + processingLeaseDuration).toISOString()
  const processingToken = uuid()
  const and: Where[] = [
    {
      completedAt: {
        exists: false,
      },
    },
    {
      hasError: {
        not_equals: true,
      },

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Authenticate the worker/cron request (default access requires a logged-in user).
2. Set `jobsConfig.access.run` to allow the worker principal.
3. Invoke runJobs with `overrideAccess: true` from a trusted worker context.

Example fix

// before
// cron hits /api/payload-jobs/run with no auth -> Forbidden

// after
jobs: { access: { run: ({ req: { user } }) => Boolean(user) || isCronRequest } }

// worker entrypoint
if (!req.user && !isCronToken(req)) {
  throw new Error('run requires auth or a recognized worker principal')
}

await runJobs({ req, overrideAccess: isCronToken(req) })

import type { PayloadRequest, User } from 'payload'

function isWorkerPrincipal(req: PayloadRequest): req is PayloadRequest & { user: User } {
  return Boolean(req.user) || isCronToken(req)
}

if (!isWorkerPrincipal(req)) throw new Error('worker auth required')

try {
  await runJobs({ req })
} catch (err) {
  if (err.statusCode === 403) {
    // authenticate the worker / cron, or set overrideAccess: true
  } else throw err
}

When it happens

Trigger: Triggering job execution (e.g. hitting the `/api/payload-jobs/run` endpoint, or calling runJobs) with an unauthenticated request or a user denied by `access.run`.

Common situations: A cron/worker hitting the run endpoint without an auth token; custom run access that excludes the worker principal; running jobs in a serverless function that lost the auth context.

Related errors

• You are not allowed to perform this action.
• Task slug "${task.slug}" is already used by a workflow. No t
• `jobs.processingLease.safetyBuffer` must be non-negative and
• Unauthorized, you must be logged in to make this request.
• Unauthorized, you must be logged in to make this request.

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/ae764a099eaa8532. Report an issue: GitHub.