vxcontrol/pentagi · error

Authentication required.

Error message

Authentication required.

What it means

The axios response interceptor (frontend/src/lib/axios.ts:104) treats HTTP 401 as 'the session is no longer valid'. It logs 'Authentication required.', removes the persisted auth data (localStorage AUTH_STORAGE_KEY), and hard-redirects the browser to the login page, preserving the current path so the user can return after re-authenticating.

Source

Thrown at frontend/src/lib/axios.ts:104

                    Log.error(
                        'Failed to parse the return value, please check if the response is returned in JSON format',
                    );
                    break;
                }

                case 400: {
                    if (err.response?.data) {
                        Log.warn(err.response.data);
                        const warns = err.response.data as Record<string, string[]>;
                        const globalMessage = warns[''] || ['Please confirm your input.'];
                        error.message = globalMessage[0] as string;
                    }

                    break;
                }

                case 401: {
                    Log.warn('Authentication required.');
                    localStorage.removeItem(AUTH_STORAGE_KEY);

                    const currentPath = window.location.pathname;

                    if (currentPath !== routes.login()) {
                        window.location.href = routes.login(currentPath);
                    }

                    break;
                }

                case 403: {
                    const responseData = err.response?.data as undefined | { code?: string };

                    if (
                        responseData?.code === 'AuthRequired' ||
                        responseData?.code === 'NotPermitted' ||
                        responseData?.code === 'PrivilegesRequired' ||

View on GitHub (pinned to ea665308ba)

Solutions

1. Re-authenticate: the interceptor already redirects to routes.login(currentPath); log in again and you will be returned to the original page.
2. Verify the client is actually sending credentials (axios `withCredentials: true` for cookie-based auth) and the backend session cookie is present and not expired.
3. If 401 appears immediately after login, check backend/auth service clocks and token lifetime configuration.
4. For in-flight auth refresh, add a refresh-token flow or a request-retry interceptor instead of relying on the hard redirect.

Example fix

// before (default instance, cookies may not be sent cross-origin)
const api = axios.create({ baseURL: API_URL });
// after
const api = axios.create({ baseURL: API_URL, withCredentials: true });

const authed = !!localStorage.getItem(AUTH_STORAGE_KEY);
if (!authed) window.location.href = routes.login(window.location.pathname);

function isUnauthorized(e: unknown): e is AxiosError {
  return axios.isAxiosError(e) && e.response?.status === 401;
}

try {
  const { data } = await api.get('/me');
  return data;
} catch (err) {
  if (isUnauthorized(err)) {
    localStorage.removeItem(AUTH_STORAGE_KEY);
    window.location.href = routes.login(window.location.pathname);
  }
  throw err;
}

When it happens

Trigger: Any API call answered with status 401: expired/revoked session cookie, expired JWT/API token, calling the API before login, or the backend rejecting a missing/invalid Authorization header or session cookie.

Common situations: User leaves a tab open until the session cookie/JWT expires and then the app performs an action; backend restarted with rotated signing keys invalidating existing tokens; user deleted their API token in settings while other tabs still use it; clock skew causing premature JWT expiry.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• You do not have permission to execute the api.
• Auth.InvalidLoginCallbackRequest
• Auth.TokenExpired
• API key is wrong
• unexpected status code: %d

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/8339aa19d840997f. Report an issue: GitHub.