pocketbase/pocketbase · error

failed to fetch AuthUser data

Error message

failed to fetch AuthUser data

What it means

Returned by the Twitch provider when the Helix `GET /users` response contains an empty `data` array after a successful token exchange. Twitch returns an empty data array when the access token does not identify a user — most commonly an app access token (client credentials) instead of a user access token, or a token whose user context could not be resolved. PocketBase has no user record to build, so it fails.

Source

Thrown at tools/auth/twitch.go:71

	if err := json.Unmarshal(data, &rawUser); err != nil {
		return nil, err
	}

	extracted := struct {
		Data []struct {
			Id              string `json:"id"`
			Login           string `json:"login"`
			DisplayName     string `json:"display_name"`
			Email           string `json:"email"`
			ProfileImageURL string `json:"profile_image_url"`
		} `json:"data"`
	}{}
	if err := json.Unmarshal(data, &extracted); err != nil {
		return nil, err
	}

	if len(extracted.Data) == 0 {
		return nil, errors.New("failed to fetch AuthUser data")
	}

	user := &AuthUser{
		Id:           extracted.Data[0].Id,
		Name:         extracted.Data[0].DisplayName,
		Username:     extracted.Data[0].Login,
		Email:        extracted.Data[0].Email,
		AvatarURL:    extracted.Data[0].ProfileImageURL,
		RawUser:      rawUser,
		AccessToken:  token.AccessToken,
		RefreshToken: token.RefreshToken,
	}

	user.Expiry, _ = types.ParseDateTime(token.Expiry)

	return user, nil
}

View on GitHub (pinned to 5d217ddb50)

Solutions

1. Ensure the login uses the authorization code flow (user is redirected and consents), not a client-credentials/app token.
2. Verify the same Twitch client_id is used for both the authorize URL and the token exchange.
3. Revoke the stored token and redo the interactive OAuth flow.
4. Decode/inspect the access token (GET /helix/users with it via curl) to confirm Twitch associates a user with it.

Example fix

# before: app token (no user) -> data: []
curl -H 'Client-Id: CID' -H 'Authorization: Bearer APP_TOKEN' https://api.twitch.tv/helix/users

# after: user token from authorization code flow -> data: [{...}]
curl -H 'Client-Id: CID' -H 'Authorization: Bearer USER_TOKEN' https://api.twitch.tv/helix/users

// before building the auth flow, assert a user token is being used
// (authorization-code flow, not client credentials)
if authMode == "client_credentials" {
    return errors.New("Twitch auth requires a user access token (authorization code flow)")
}

user, err := provider.FetchAuthUser(token)
if err != nil && strings.Contains(err.Error(), "failed to fetch AuthUser data") {
    // discard cached token and restart interactive flow
    return restartOAuthFlow()

When it happens

Trigger: Completing the OAuth code exchange with a client-credentials/app token instead of the authorization-code flow; the token request used the wrong client_id (Twitch resolves user context per client); authorization was skipped so no user was attached to the token.

Common situations: Mixing up app tokens and user tokens when scripting Twitch integrations; client_id used at token exchange differing from the one used at authorize; sandbox/test setup where the user never actually authorized.

Related errors

• the mailcow user is not active
• the monday.com user account is not enabled
• the user is not active
• missing response entry
• empty id_token

AI-assisted analysis of pocketbase/pocketbase@5d217ddb50 (2026-08-15). Data as JSON: /api/errors/fb96de6e70845ffd. Report an issue: GitHub.