OIDC (authentik) leads to log entries of “unauthorized” users

[obakuhl]

Issue description
I get Error #01: you need to provide a valid access token or user credentials to access this api in my log even if I just open the external URL Gotify server instace. This also happens when I try the same with the internal IP address of the Gotify server. So no other user actions happened, except that the website was accessed.
I have OIDC enabled. As identity provider I use authentik (2026.5.6).
When I try to login I get Flow does not apply to current user. But I haven't set any bindings in authentik for gotify what could prevent the access.

Previously (v3.0.0) it worked and everything was set up according to the official authentik documentation.

Can the issue be reproduced with the latest available release? (y/n)
Yes [3.1.1], issue appears since 3.1.0

Which one is the environment gotify server is running in?

• Docker
• Linux machine
• Windows machine

Docker startup command or config file here (please mask sensitive information)

Do you have an reverse proxy installed in front of gotify server? (Please select None if the problem can be reproduced without the presense of a reverse proxy)

• None
• Nginx
• Apache
• Caddy

I selected none since the issue also appears without the presense of the reverse proxy.

Reverse proxy configuration (please mask sensitive information)

On which client do you experience problems? (Select as many as you can see)

• WebUI
• gotify-cli
• Android Client
• 3rd-party API call (Please include your code)

What did you do?
I just entered my Gotify server instace URL and can see the login interface.

What did you expect to see?
The login interface.

What did you see instead? (Include screenshots, android logcat/request dumps if possible)

2026-09-19T11:19:33+02:00 WRN HTTP duration="81µs" errors="Error #01: you need to provide a valid access token or user credentials to access this api" ip=x.x.x.x method=GET path=/current/user status=401
2026-09-19T11:19:33+02:00 INF HTTP duration="213.9µs" ip=x.x.x.x method=GET path=/static/roboto-latin-400-normal-BqEyEoaF.woff2 status=200
2026-09-19T11:19:33+02:00 INF HTTP duration="31µs" ip=x.x.x.x method=GET path=/static/favicon-32x32.png status=200
2026-09-19T11:19:33+02:00 INF HTTP duration="125.2µs" ip=x.x.x.x method=GET path=/static/favicon-196x196.png status=200
2026-09-19T11:19:57+02:00 INF HTTP duration="375.5µs" ip=x.x.x.x method=GET path=/stream?token=[masked] status=200
2026-09-19T11:19:57+02:00 INF HTTP duration="599.1µs" ip=x.x.x.x method=GET path=/message?limit=10 status=200

gotify-server-env
x.x.x.x = reverse proxy IP

GOTIFY_DATABASE_CONNECTION="data/gotify.db"
GOTIFY_DATABASE_DIALECT="sqlite3"
GOTIFY_DEFAULTUSER_NAME="NAME"
GOTIFY_DEFAULTUSER_PASS="PASS"
GOTIFY_PASSSTRENGTH=10
GOTIFY_PLUGINSDIR="data/plugins"
GOTIFY_SERVER_LISTENADDR="127.0.0.1"
GOTIFY_SERVER_PORT=5000
GOTIFY_SERVER_SSL_ENABLED="false"
GOTIFY_SERVER_SSL_LETSENCRYPT_ACCEPTTOS="false"
GOTIFY_SERVER_SSL_LETSENCRYPT_CACHE="data/certs"
GOTIFY_SERVER_SSL_LETSENCRYPT_ENABLED="false"
GOTIFY_SERVER_SSL_LISTENADDR=""
GOTIFY_SERVER_SSL_PORT=443
GOTIFY_SERVER_SSL_REDIRECTTOHTTPS="false"
GOTIFY_SERVER_TRUSTEDPROXIES="127.0.0.1,x.x.x.x"
GOTIFY_UPLOADEDIMAGESDIR="data/images"
GOTIFY_OIDC_ENABLED=true
GOTIFY_OIDC_ISSUER=https://sso.authentikURL.com/application/o/gotify/
GOTIFY_OIDC_CLIENTID=CLIENTID
GOTIFY_OIDC_CLIENTSECRET=CLIENTSECRET
GOTIFY_OIDC_REDIRECTURL=https://push.gotifyURL.com/auth/oidc/callback
GOTIFY_OIDC_AUTOREGISTER=true
GOTIFY_OIDC_USERNAMECLAIM=preferred_username
GOTIFY_OIDC_LINK_BY_USERNAME=true
GOTIFY_OIDC_SCOPES=openid,profile,email

Authentik provider settings

[jmattheis]

The error "you need to provide a valid access token or user credentials to access this api" is by design, the UI tries to authenticate, and checks if there is an active session.

Please also post the authentik log with debug log enabled. My authentik deployment does work with the newest version, so this is likely a misconfiguration in authentik.

You can try setting GOTIFY_OIDC_PROMPT to an empty string, but I'd expect this doesn't change anything. (This was added in 3.1.0 with the default "prompt").

# like this
GOTIFY_OIDC_PROMPT=

[obakuhl]

Thanks for the quick feedback. Actually GOTIFY_OIDC_PROMPT= solves the problem.
I can later post the debug logs of without GOTIFY_OIDC_PROMPT= and with to support in identifing the issue, but they are quite massive and I need to have a sanity check and identify the right lines.

Even with that (empty) variable I see a log entry of Error #01: you need to provide a valid access token or user credentials to access this api, but you said this is intended.

The reverse proxy’s Fail2ban is quite sensitive, which can result in you losing access.