[api] Unauthorized access attempt - make sure your GRAPHQL_PORT and API_TOKEN settings are correct

[jeffmrich]

Anyone know what's causing this every 10 seconds?

[api] Unauthorized access attempt - make sure your GRAPHQL_PORT and API_TOKEN settings are correct

Everything's working, and I've verified that I can curl localhost:20212/graphql with the api token, without issue. So it would appear that something internal is trying to access 20212/graphql without using the api token.

[jokob-sk]

There might be a front end open on one of your devices with old settings/credentials (GRAPHQL_PORT and API_TOKEN setting) or a misconfiguration on a SYNC node https://github.com/netalertx/NetAlertX/tree/main/front/plugins/sync

[mamekedi]

I have the same issue i really don't know how to soldeer this no clue

[jeffmrich]

This all simply stopped happening yesterday, appearing to coincide with most of my 53 devices clicking over from "New" to "Online". A race condition maybe with so many "New" devices trying to do "something" simultaneously and failing(?).

@jokob-sk no idea what you mean by " ... might be a front end open on one of your devices with old settings/credentials" - and I'm not using multiple instances.

You have any further thoughts on what's happening here? Surely others have come across this?

[mamekedi]

On which part of the logs do we have to look

[jokob-sk]

See the docs on how to access the logs. Here is a sample entry which shows the origin of the request (here 192.1.1.105:20212):

17:00:10 [HTTP] Headers: {'Host': '192.1.1.105:20212', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.9', 'Accept-Encoding': 'gzip, deflate', 'Dnt': '1', 'Connection': 'keep-alive', 'Upgrade-Insecure-Requests': '1', 'Priority': 'u=0, i'}
17:00:10 [SSE] Broadcasted event: unread_notifications_count_update
17:00:10 [api] Unauthorized access attempt - make sure your GRAPHQL_PORT and API_TOKEN settings are correct.

[mamekedi]

Here my log

09:25:02 [HTTP] OPTIONS /messaging/in-app/unread from 192.168.1.48

192.168.1.48 - - [25/Jan/2026 09:25:02] "OPTIONS /messaging/in-app/unread HTTP/1.1" 200 -

09:25:02 [HTTP] GET /messaging/in-app/unread from 192.168.1.48

09:25:02 [api] Unauthorized access attempt - make sure your GRAPHQL_PORT and API_TOKEN settings are correct.

192.168.1.48 - - [25/Jan/2026 09:25:02] "[31m[1mGET /messaging/in-app/unread HTTP/1.1[0m" 403 -

09:25:03 [WF] get_new_app_events - new events count: 0

09:25:08 [WF] get_new_app_events - new events count: 0

09:25:09 [HTTP] OPTIONS /sse/state from 192.168.1.48

192.168.1.48 - - [25/Jan/2026 09:25:09] "OPTIONS /sse/state?client=client-3e0vbkndq HTTP/1.1" 200 -

09:25:09 [HTTP] GET /sse/state from 192.168.1.48

09:25:09 [api] Unauthorized access attempt - make sure your GRAPHQL_PORT and API_TOKEN settings are correct.

192.168.1.48 - - [25/Jan/2026 09:25:09] "[31m[1mGET /sse/state?client=client-3e0vbkndq HTTP/1.1[0m" 401 -

09:25:13 [WF] get_new_app_events - new events count: 0

09:25:14 [HTTP] OPTIONS /sse/state from 192.168.1.48

192.168.1.48 - - [25/Jan/2026 09:25:14] "OPTIONS /sse/state?client=client-3e0vbkndq HTTP/1.1" 200 -

09:25:14 [HTTP] GET /sse/state from 192.168.1.48

09:25:14 [api] Unauthorized access attempt - make sure your GRAPHQL_PORT and API_TOKEN settings are correct.

192.168.1.48 - - [25/Jan/2026 09:25:14] "[31m[1mGET /sse/state?client=client-3e0vbkndq HTTP/1.1[0m" 401 -

Almost always on the same ip

[jokob-sk]

As mentioned earlier, looks like a browser open on the 192.168.1.48 accessing your instance. Close the session and log entries should disappear

[mamekedi]

Oke thank you