phacility/phabricator · error · ConduitException

ERR-INVALID-USER

ERR-INVALID-USER

Error message

ERR-INVALID-USER

What it means

In the legacy conduit.connect handshake, the submitted 'user' parameter is looked up with an exact username match (loadOneWhere('username = %s')). No matching PhabricatorUser row yields ConduitException 'ERR-INVALID-USER'. Note conduit.connect is a deprecated old-style auth mechanism; modern clients authenticate with API tokens instead.

Source

Thrown at src/applications/conduit/method/ConduitConnectConduitAPIMethod.php:110

                'to connect to this server (you are running version '.
                '%d, the server is running version %d).',
                $client_version,
                $server_version));
          }
          throw $ex;
        }
        break;
      default:
        // Allow new clients by default.
        break;
    }

    $token = $request->getValue('authToken');
    $signature = $request->getValue('authSignature');

    $user = id(new PhabricatorUser())->loadOneWhere('username = %s', $username);
    if (!$user) {
      throw new ConduitException('ERR-INVALID-USER');
    }

    $session_key = null;
    if ($token && $signature) {
      $threshold = 60 * 15;
      $now = time();
      if (abs($token - $now) > $threshold) {
        throw id(new ConduitException('ERR-INVALID-TOKEN'))
          ->setErrorDescription(
            pht(
              'The request you submitted is signed with a timestamp, but that '.
              'timestamp is not within %s of the current time. The '.
              'signed timestamp is %s (%s), and the current server time is '.
              '%s (%s). This is a difference of %s seconds, but the '.
              'timestamp must differ from the server time by no more than '.
              '%s seconds. Your client or server clock may not be set '.
              'correctly.',
              phutil_format_relative_time($threshold),

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Confirm and resend the exact username as stored in Phabricator.
2. Prefer modern authentication: install an API token with 'arc install-certificate' (or send it as a Conduit token) instead of conduit.connect.
3. Upgrade the client tooling so the legacy handshake is no longer used.

// Old-style client: handle the error code returned in the Conduit response.
try {
  $result = $call->execute();
} catch (ConduitException $ex) {
  if ($ex->getMessage() === 'ERR-INVALID-USER') {
    // Username does not exist: surface a clear message, do not blind-retry.
  }
  throw $ex;
}

When it happens

Trigger: Calling conduit.connect with a misspelled or nonexistent username; using the user's display name or email instead of the username; the account having been renamed or deleted.

Common situations: Very old arc versions or custom clients still speaking the certificate protocol; scripts written against ancient Phabricator instances reused on new ones where the account was never migrated.

Related errors

• ERR-INVALID-CERTIFICATE
• ERR-NO-CERTIFICATE
• ERR-RATE-LIMIT
• ERR-BAD-TOKEN
• Certificate token points to an invalid user!

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/bee79e2d95ed14e2. Report an issue: GitHub.