Overview
This entry explains how to troubleshoot an invalid token error when an API token still appears in Ambience/Repertoire 202x and is configured with no expiry date.
Selecting Never prevents the token from expiring based on time. However, the token must also be enabled, supplied correctly, and associated with an active user.
This guide covers two possible scenarios:
- The associated user still exists and remains linked to the token.
- The associated user has been removed, leaving the token without a valid user association.
Step 1: Identify The Error Context
The invalid token error occurs when an application sends an API request, but Ambience/Repertoire 202x cannot authenticate the supplied token.
WARN ambience.module.APITokenCodexDB - access with b1383e42-c502-450a-9e37-44f0b609ba25 failed - invalid token
Typical observations include:
- The token remains visible in the API Tokens module.
- The token is configured with Never as its expiry.
- The application previously used the token successfully.
- New requests using the token are now rejected.
A token configured with Never does not expire automatically. However, this setting controls only time-based expiration and does not guarantee that the token remains valid under all circumstances.
Step 2: Verify The API Token Configuration
Open the API Tokens module and locate the affected token. Confirm that:
- The token is enabled.
- Its expiry is set to Never, or its expiry date has not passed.
- The application is sending the exact token value.
- The token value does not contain leading or trailing spaces.
- The token belongs to the server and environment receiving the request.
- The token is supplied using the authentication method expected by the API endpoint.
Step 3: Check The User Association
Open the affected token using Modify or Edit, and check the User field.
Scenario 1: The User Exists and Remains Linked
If an active user is displayed in the User field, check whether the associated user has the required roles and privileges.
Scenario 2: The Associated User Is Missing
An API token may remain visible after its associated user has been removed. Without an active user association, Ambience/Repertoire 202x cannot identify the user represented by the token and will reject the request.
Ambience/Repertoire 202x does not automatically remove users. Removing a user or changing the user’s settings requires human intervention by someone with the appropriate administrative access. Administrators should therefore check internally whether the user was manually removed.
To restore access:
- Identify an appropriate active user with the required privileges.
- Select Modify or Edit for the affected token.
- Select the active user in the User field.
- Save the changes.
- Refresh the API Tokens page.
- Reopen the token and confirm that the association was retained.
- Retry the API request.
Step 4: Test The API Token
Retry the affected API request after completing the verification steps above. If the token remains invalid despite all configurations being correct, collect the relevant server logs and contact Elixir Support for further assistance.
What This Clarification Achieves
- Explains why a token configured with Never can still become invalid.
- Clarifies that an API token depends on its associated user.
- Covers cases where the user remains linked and where the user is missing.
- Confirms that removing a user requires human administrative intervention.