[GH-ISSUE #4861] "Request failed with status code 401 Error: Token invalid" when attempting to view dashboard #9960

Closed
opened 2026-08-05 01:24:09 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @its-wizza on GitHub (Nov 26, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4861

Describe the problem

Cannot view NetBird webpage. Installed and used NetBird successfully up until this point. Auth is via authentik.

To Reproduce

Steps to reproduce the behavior:

  1. Install selfhosted NetBird, using authentik as auth provider.
  2. Not sure of exact trigger - potentially setting Group Binding in Application definition in authentik (of which NetBird service account was not a member), or logging in with a second account on the same device. I originally was only using the owner account to log in to NetBird, after adding a second account and attempting to log in in an incognito tab, I started getting the error (for both users).
  3. Log in. Authenticate via authentik, get redirected back to the Netbird dashboard and you will see the error.
  4. Remove group binding in authentik.
  5. Continue to get error.

Expected behavior

Login to work correctly

Are you using NetBird Cloud?

Selfhosted

NetBird version

netbird-mgmt version 0.60.2

Is any other VPN software installed?

No

Screenshots

Image

Additional context

On start, management container logs:

...
2025-11-26T11:41:34Z WARN management/server/account.go:252: failed warming up cache due to error: unable to get authentik token, statusCode 400
...

After logging in via authentik, and getting the 401 error on the dashboard page:

...
2025-11-26T11:56:31Z ERRO [context: HTTP, requestID: 818e8e8c-55e3-4c27-ac50-275cc0152fab] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400
2025-11-26T11:56:31Z ERRO [context: HTTP, requestID: 818e8e8c-55e3-4c27-ac50-275cc0152fab] shared/management/http/util/util.go:85: got a handler error: token invalid
2025-11-26T11:56:31Z ERRO [context: HTTP, requestID: 818e8e8c-55e3-4c27-ac50-275cc0152fab] management/server/telemetry/http_api_metrics.go:189: HTTP response 818e8e8c-55e3-4c27-ac50-275cc0152fab: GET /api/users status 401
2025-11-26T11:56:33Z ERRO [context: HTTP, requestID: 09125fcf-878f-4df6-9d6d-caefdd4eb7d7] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400
2025-11-26T11:56:33Z ERRO [context: HTTP, requestID: 09125fcf-878f-4df6-9d6d-caefdd4eb7d7] shared/management/http/util/util.go:85: got a handler error: token invalid
2025-11-26T11:56:33Z ERRO [requestID: 09125fcf-878f-4df6-9d6d-caefdd4eb7d7, context: HTTP] management/server/telemetry/http_api_metrics.go:189: HTTP response 09125fcf-878f-4df6-9d6d-caefdd4eb7d7: GET /api/users status 401
2025-11-26T11:56:41Z ERRO [context: HTTP, requestID: 18c1e3df-ffac-4ac9-a0e3-d204d1498d76] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400
2025-11-26T11:56:41Z ERRO [context: HTTP, requestID: 18c1e3df-ffac-4ac9-a0e3-d204d1498d76] shared/management/http/util/util.go:85: got a handler error: token invalid
2025-11-26T11:56:41Z ERRO [context: HTTP, requestID: 18c1e3df-ffac-4ac9-a0e3-d204d1498d76] management/server/telemetry/http_api_metrics.go:189: HTTP response 18c1e3df-ffac-4ac9-a0e3-d204d1498d76: GET /api/users/current status 401
...

I have not yet tried rebuilding the authentik auth setup from scratch, trying to avoid doing so in case I lose access to my existing users and config I have created in NetBird.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @its-wizza on GitHub (Nov 26, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4861 **Describe the problem** Cannot view NetBird webpage. Installed and used NetBird successfully up until this point. Auth is via authentik. **To Reproduce** Steps to reproduce the behavior: 1. Install selfhosted NetBird, using authentik as auth provider. 2. Not sure of exact trigger - potentially setting Group Binding in Application definition in authentik (of which NetBird service account was not a member), or logging in with a second account on the same device. I originally was only using the owner account to log in to NetBird, after adding a second account and attempting to log in in an incognito tab, I started getting the error (for both users). 3. Log in. Authenticate via authentik, get redirected back to the Netbird dashboard and you will see the error. 4. Remove group binding in authentik. 5. Continue to get error. **Expected behavior** Login to work correctly **Are you using NetBird Cloud?** Selfhosted **NetBird version** `netbird-mgmt version 0.60.2` **Is any other VPN software installed?** No **Screenshots** <img width="2560" height="1540" alt="Image" src="https://github.com/user-attachments/assets/0b6f3fb7-b1cd-4180-83ad-3508f5e79532" /> **Additional context** On start, management container logs: ``` ... 2025-11-26T11:41:34Z WARN management/server/account.go:252: failed warming up cache due to error: unable to get authentik token, statusCode 400 ... ``` After logging in via authentik, and getting the 401 error on the dashboard page: ``` ... 2025-11-26T11:56:31Z ERRO [context: HTTP, requestID: 818e8e8c-55e3-4c27-ac50-275cc0152fab] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400 2025-11-26T11:56:31Z ERRO [context: HTTP, requestID: 818e8e8c-55e3-4c27-ac50-275cc0152fab] shared/management/http/util/util.go:85: got a handler error: token invalid 2025-11-26T11:56:31Z ERRO [context: HTTP, requestID: 818e8e8c-55e3-4c27-ac50-275cc0152fab] management/server/telemetry/http_api_metrics.go:189: HTTP response 818e8e8c-55e3-4c27-ac50-275cc0152fab: GET /api/users status 401 2025-11-26T11:56:33Z ERRO [context: HTTP, requestID: 09125fcf-878f-4df6-9d6d-caefdd4eb7d7] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400 2025-11-26T11:56:33Z ERRO [context: HTTP, requestID: 09125fcf-878f-4df6-9d6d-caefdd4eb7d7] shared/management/http/util/util.go:85: got a handler error: token invalid 2025-11-26T11:56:33Z ERRO [requestID: 09125fcf-878f-4df6-9d6d-caefdd4eb7d7, context: HTTP] management/server/telemetry/http_api_metrics.go:189: HTTP response 09125fcf-878f-4df6-9d6d-caefdd4eb7d7: GET /api/users status 401 2025-11-26T11:56:41Z ERRO [context: HTTP, requestID: 18c1e3df-ffac-4ac9-a0e3-d204d1498d76] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400 2025-11-26T11:56:41Z ERRO [context: HTTP, requestID: 18c1e3df-ffac-4ac9-a0e3-d204d1498d76] shared/management/http/util/util.go:85: got a handler error: token invalid 2025-11-26T11:56:41Z ERRO [context: HTTP, requestID: 18c1e3df-ffac-4ac9-a0e3-d204d1498d76] management/server/telemetry/http_api_metrics.go:189: HTTP response 18c1e3df-ffac-4ac9-a0e3-d204d1498d76: GET /api/users/current status 401 ... ``` I have not yet tried rebuilding the authentik auth setup from scratch, trying to avoid doing so in case I lose access to my existing users and config I have created in NetBird. **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:24:09 -04:00
Author
Owner

@its-wizza commented on GitHub (Nov 26, 2025):

I believe the problem did relate to not including the NetBird service account in the group I used for binding in the authentik application. After adding the account it still produced the same error, not sure why. After recreating the app token for the account and adjusting setup.env + running ./configure.sh, the issue was resolved.

<!-- gh-comment-id:3581110166 --> @its-wizza commented on GitHub (Nov 26, 2025): I believe the problem did relate to not including the NetBird service account in the group I used for binding in the authentik application. After adding the account it still produced the same error, not sure why. After recreating the app token for the account and adjusting setup.env + running ./configure.sh, the issue was resolved.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9960