What causes "Certificate token points to an invalid user!" in phacility/phabricator?

Mint a fresh token as an existing user and redeem it promptly; the new row will reference a live PHID.

phacility/phabricator · error · Exception

Certificate token points to an invalid user!

Error message

Certificate token points to an invalid user!

What it means

After a certificate token row validates, conduit.getcertificate loads the user by the row's userPHID. If no PhabricatorUser matches that PHID, the token references a user that no longer exists and a plain Exception is thrown ('Certificate token points to an invalid user!'). This is a data-integrity break between the token table and the user table, not a client-input error.

Source

Thrown at src/applications/conduit/method/ConduitGetCertificateConduitAPIMethod.php:72

      'token = %s',
      trim($token));

    if (!$info || $info->getDateCreated() < time() - (60 * 15)) {
      $this->logFailure($request, $info);
      throw new ConduitException('ERR-BAD-TOKEN');
    } else {
      $log = PhabricatorUserLog::initializeNewLog(
          $request->getUser(),
          $info->getUserPHID(),
          PhabricatorConduitCertificateUserLogType::LOGTYPE)
        ->save();
    }

    $user = id(new PhabricatorUser())->loadOneWhere(
      'phid = %s',
      $info->getUserPHID());
    if (!$user) {
      throw new Exception(pht('Certificate token points to an invalid user!'));
    }

    return array(
      'username'    => $user->getUserName(),
      'certificate' => $user->getConduitCertificate(),
    );
  }

  private function logFailure(
    ConduitAPIRequest $request,
    PhabricatorConduitCertificateToken $info = null) {

    $log = PhabricatorUserLog::initializeNewLog(
        $request->getUser(),
        $info ? $info->getUserPHID() : '-',
        PhabricatorConduitCertificateFailureUserLogType::LOGTYPE)
      ->save();
  }

View on GitHub (pinned to 5720a38cfe)

Solutions

Mint a fresh token as an existing user and redeem it promptly; the new row will reference a live PHID.
If it recurs, inspect phabricator_conduit_certificate_token for rows whose userPHID has no match in the user table and purge stale rows.
Audit why the user record disappeared (deletion, restore, import) before recreating the account.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  $result = $call->execute();
} catch (Exception $ex) {
  if (preg_match('/invalid user/', $ex->getMessage())) {
    // Server-side integrity issue: mint a new token for an existing user and retry.
  }
}

Prevention

Delete or disable bot accounts deliberately and purge their outstanding certificate tokens.
After partial DB restores or imports, check token tables for PHIDs with no matching user row.

When it happens

Trigger: The user account was deleted (or the row lost in a partial DB restore/import) between token creation and redemption; PHID references desynchronized after manual database surgery.

Common situations: Rare operational edge: token minted, then the owning account (often a bot) removed; dev/staging databases copied inconsistently from production.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/2503dae313050242. Report an issue: GitHub.