Deleting Access token not working

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 32.0.9 - 32.0.9.2
  • Operating system and version (e.g., Ubuntu 24.04):
    • Linux 6.8.0-106-generic #106-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 6 07:58:08 UTC 2026 x86_64
  • Web server and version (e.g, Apache 2.4.25):
    • nginx/1.29.2 (fpm-fcgi)
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • unknown
  • PHP version (e.g, 8.3):
    • 8.3.30
  • Is this the first time you’ve seen this error? (Yes / No):
    • Yes (not used before)
  • When did this problem seem to first start?
    • used first today
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Unknown (SaaS)
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • no

Summary of the issue you are facing:

When attempting to delete an app-token, the message “Could not delete the app token” appears.

Steps to replicate it (hint: details matter!):

  1. Go to Settings → Security → Devices & sessions

  2. Click on the delete icon

  3. The message appears directly

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.

No logs on the server, no request is sent (seen in the developer tools of the browser)

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

Notifications permissions granted NotificationsApp.vue:449:13
Has notify_push enabled, slowing polling to 15 minutes NotificationsApp.vue:230:12
Polling interval updated to 900000 NotificationsApp.vue:412:12
Started background fetcher as session_keepalive is enabled NotificationsApp.vue:279:13
Got notification data, restoring default polling interval. NotificationsApp.vue:368:13
[ERROR] settings: Could not delete app token 
Object { app: "settings", uid: "mgreipl", level: 2, error: ReferenceError }
​
app: "settings"
​
error: ReferenceError: PwdConfirmationMode is not defined
​
level: 2
​
uid: "mgreipl"
​
<prototype>: Object { … }
index.mjs:47:17
    log index.mjs:47
    error index.mjs:65
    deleteToken authtoken.ts:70
    a pinia.mjs:1399
    revoke AuthToken.vue:207
    click AuthToken.vue:1
    click NcActions-BcLis_nr.mjs:724
    VueJS 4
    click NcButton-BaZAY-tN.mjs:285
    VueJS 65
    15974 main-personal-security.js:23
    Webpack 5

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

{
    "skeletondirectory": "\/var\/w***REMOVED SENSITIVE VALUE***",
    "simpleSignUpLink.shown": false,
    "forbidden_filenames": [],
    "memcache.local": "\\OC\\Memcache\\APCu",
    "appstoreurl": "***REMOVED SENSITIVE VALUE***",
    "allow_local_remote_servers": true,
    "apps_paths": [
        {
            "path": "\/var\/www\/html\/apps",
            "url": "\/apps",
            "writable": false
        },
        {
            "path": "\/var\/www\/html\/custom_apps",
            "url": "\/custom_apps",
            "writable": true
        }
    ],
    "files_external_allow_create_new_local": false,
    "loglevel": 2,
    "log_type": "syslog",
    "updatechecker": false,
    "updater.server.url": "***REMOVED SENSITIVE VALUE***",
    "updater.release.channel": "stable",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "32.0.9.2",
    "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "default_language": "de",
    "default_locale": "de",
    "default_phone_region": "DE",
    "mail_smtpmode": "smtp",
    "mail_smtpauthtype": "LOGIN",
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "syslog_tag": "nextcloud-23745987",
    "upgrade.disable-web": true,
    "theme": "custom",
    "templatedirectory": "\/var\/www\/html\/core\/skeleton\/Templates\/",
    "enabledPreviewProviders": [
        "OC\\Preview\\PNG",
        "OC\\Preview\\JPEG",
        "OC\\Preview\\GIF",
        "OC\\Preview\\BMP",
        "OC\\Preview\\XBitmap",
        "OC\\Preview\\MP3",
        "OC\\Preview\\TXT",
        "OC\\Preview\\MarkDown",
        "OC\\Preview\\OpenDocument",
        "OC\\Preview\\Krita",
        "OC\\Preview\\HEIC"
    ],
    "activity_expire_days": "31",
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "port": "6379",
        "timeout": "1.5",
        "dbindex": "0"
    },
    "filelocking.enabled": true,
    "memcache.locking": "\\OC\\Memcache\\Redis",
    "memcache.distributed": "\\OC\\Memcache\\Redis",
    "maintenance": false,
    "maintenance_window_start": 1,
    "davstorage.request_timeout": 10800,
    "app_install_overwrite": [
        "files_rightclick"
    ],
    "bulkupload.enabled": true,
    "remember_login_cookie_lifetime": 0,
    "mail_sendmailmode": "smtp",
    "mail_smtpport": "587",
    "mail_smtpauth": true,
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "***REMOVED SENSITIVE VALUE***",
        "***REMOVED SENSITIVE VALUE***"
    ]
}

Apps

The output of occ app:list (if possible).

This looks like a legitimate oversight in v32.0.9 to me related to the backporting of some changes in the password confirmation logic; it’s okay in v33/v34-dev.

May want to report it to GitHub - nextcloud/server: ☁️ Nextcloud server, a safe home for all your data · GitHub (and reference PRs #59607)

Yes! I can confirm this bug and created an issue:


ernolf