github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-07-11 11:59:55 -05:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[GH-ISSUE #8023] [Bug]: Invalid SimpleFIN access token breaking sync #117645

New Issue
Closed
opened 2026-06-11 13:04:52 -05:00 by GiteaMirror · 16 comments
GiteaMirror commented 2026-06-11 13:04:52 -05:00
Owner
Copy Link

Originally created by @KevinIsMyName on GitHub (Jun 1, 2026).
Original GitHub issue: https://github.com/actualbudget/actual/issues/8023

What happened?

I upgraded from v26.5.2 to v26.6.0. I was trying to "Bank Sync" in "All Accounts" and it failed. "All Accounts" use one SimpleFIN connection; none are local. I deleted the existing SimpleFIN connection, re-created and configured a new SimpleFIN token, and clicked "Link bank account" to test its connection and see if my financial institutions show up.

Expected: Bank Sync updates when using SimpleFIN
Actual: Fails to update.

Expected: Entering a new SimpleFIN token in Bank Setup > SimpleFIN > Edit setup with the "Set-up SimpleFIN" modal and then clicking "Link a new bank account" should show my financial institutions
Actual: Clicking "Link a new bank account" opens the "Set-up SimpleFIN" modal instead of showing my financial institutions

How can we reproduce the issue?

  1. Navigate to More > Bank Sync > SimpleFIN >
  2. Click three-dots-icon and "Reset SimpleFIN credentials"
  3. Enter a SimpleFIN token it at More > Bank Sync > SimpleFIN > Edit Setup. This is the "Set-up SimpleFIN" modal.
  4. Click "Save and continue" to proceed.
  5. Observe that the token saved successfully in Dev Tools > Network tab:
curl 'https://[MASKED]:5006/secret' \
  -H 'Referer: https://[MASKED]:5006/static/js/browser-server.Bn9r7T7W.js' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36' \
  -H 'DNT: 1' \
  -H 'Content-Type: application/json' \
  -H 'X-ACTUAL-TOKEN: 944fe034-07d9-4daf-9011-a2fd11d805a2' \
  --data-raw '{"name":"simplefin_token","value":"[MASKED]"}'

{"status":"ok"}
  1. Click "Link Bank Account"
  2. Observe that that the "Set-up SimpleFIN" modal has re-appeared and does not show you financial institutions.
  3. Observe the following API response in the Dev Tools > Network tab:
curl 'https://[MASKED]:5006/simplefin/accounts' \
  -H 'Referer: https://[MASKED]:5006/static/js/browser-server.Bn9r7T7W.js' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36' \
  -H 'DNT: 1' \
  -H 'Content-Type: application/json' \
  -H 'X-ACTUAL-TOKEN: 944fe034-07d9-4daf-9011-a2fd11d805a2' \
  --data-raw '{}'

{"status":"ok","data":{"error_type":"SERVER_DOWN","error_code":"SERVER_DOWN","status":"rejected","reason":"There was an error communicating with SimpleFIN."}}

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Windows 11

Originally created by @KevinIsMyName on GitHub (Jun 1, 2026). Original GitHub issue: https://github.com/actualbudget/actual/issues/8023 ### What happened? I upgraded from v26.5.2 to v26.6.0. I was trying to "Bank Sync" in "All Accounts" and it failed. "All Accounts" use one SimpleFIN connection; none are local. I deleted the existing SimpleFIN connection, re-created and configured a new SimpleFIN token, and clicked "Link bank account" to test its connection and see if my financial institutions show up. Expected: Bank Sync updates when using SimpleFIN Actual: Fails to update. Expected: Entering a new SimpleFIN token in Bank Setup > SimpleFIN > Edit setup with the "Set-up SimpleFIN" modal and then clicking "Link a new bank account" should show my financial institutions Actual: Clicking "Link a new bank account" opens the "Set-up SimpleFIN" modal instead of showing my financial institutions ### How can we reproduce the issue? 1. Navigate to More > Bank Sync > SimpleFIN > 2. Click three-dots-icon and "Reset SimpleFIN credentials" 3. Enter a SimpleFIN token it at More > Bank Sync > SimpleFIN > Edit Setup. This is the "Set-up SimpleFIN" modal. 5. Click "Save and continue" to proceed. 6. Observe that the token saved successfully in Dev Tools > Network tab: ``` curl 'https://[MASKED]:5006/secret' \ -H 'Referer: https://[MASKED]:5006/static/js/browser-server.Bn9r7T7W.js' \ -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36' \ -H 'DNT: 1' \ -H 'Content-Type: application/json' \ -H 'X-ACTUAL-TOKEN: 944fe034-07d9-4daf-9011-a2fd11d805a2' \ --data-raw '{"name":"simplefin_token","value":"[MASKED]"}' {"status":"ok"} ``` 7. Click "Link Bank Account" 8. Observe that that the "Set-up SimpleFIN" modal has re-appeared and does not show you financial institutions. 9. Observe the following API response in the Dev Tools > Network tab: ``` curl 'https://[MASKED]:5006/simplefin/accounts' \ -H 'Referer: https://[MASKED]:5006/static/js/browser-server.Bn9r7T7W.js' \ -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36' \ -H 'DNT: 1' \ -H 'Content-Type: application/json' \ -H 'X-ACTUAL-TOKEN: 944fe034-07d9-4daf-9011-a2fd11d805a2' \ --data-raw '{}' {"status":"ok","data":{"error_type":"SERVER_DOWN","error_code":"SERVER_DOWN","status":"rejected","reason":"There was an error communicating with SimpleFIN."}} ``` ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Chrome ### Operating System Windows 11
GiteaMirror added the bugbank sync labels 2026-06-11 13:04:53 -05:00
GiteaMirror commented 2026-06-11 13:04:57 -05:00
Author
Owner
Copy Link

@KevinIsMyName commented on GitHub (Jun 1, 2026):

FYI, I have stood up an alternate Docker instance with v26.5.2 to test the same SimpleFIN connection (with same token) and I was not able to reproduce this.

<!-- gh-comment-id:4595513816 --> @KevinIsMyName commented on GitHub (Jun 1, 2026): FYI, I have stood up an alternate Docker instance with v26.5.2 to test the same SimpleFIN connection (with same token) and I was not able to reproduce this.
GiteaMirror commented 2026-06-11 13:04:59 -05:00
Author
Owner
Copy Link

@matt-fidd commented on GitHub (Jun 1, 2026):

@youngcw do you use SimpleFIN on nightly?

<!-- gh-comment-id:4595528946 --> @matt-fidd commented on GitHub (Jun 1, 2026): @youngcw do you use SimpleFIN on nightly?
GiteaMirror commented 2026-06-11 13:05:01 -05:00
Author
Owner
Copy Link

@youngcw commented on GitHub (Jun 1, 2026):

Simplefin is working fine for me. I haven't tried adding new connection though

<!-- gh-comment-id:4595848906 --> @youngcw commented on GitHub (Jun 1, 2026): Simplefin is working fine for me. I haven't tried adding new connection though
GiteaMirror commented 2026-06-11 13:05:05 -05:00
Author
Owner
Copy Link

@KevinIsMyName commented on GitHub (Jun 1, 2026):

Could you try it with an budget upgraded from 26.5.2->26.6.0? I set up two new instances aside from my production instance, v26.6.0 and v26.5.2, and they both have their own SimpleFIN tokens and all pull from SimpleFIN successfully, but not my production instance, which was upgraded 26.5.2->26.6.0 today. All three instances have different SimpleFIN tokens.

I can live with promoting the new 26.6.0 instance to production. It's a few days out-of-date, but bank sync works. I will continue looking for the root cause in the meantime

<!-- gh-comment-id:4595885288 --> @KevinIsMyName commented on GitHub (Jun 1, 2026): Could you try it with an budget upgraded from 26.5.2->26.6.0? I set up two new instances aside from my production instance, v26.6.0 and v26.5.2, and they both have their own SimpleFIN tokens and all pull from SimpleFIN successfully, but not my production instance, which was upgraded 26.5.2->26.6.0 today. All three instances have different SimpleFIN tokens. I can live with promoting the new 26.6.0 instance to production. It's a few days out-of-date, but bank sync works. I will continue looking for the root cause in the meantime
GiteaMirror commented 2026-06-11 13:05:08 -05:00
Author
Owner
Copy Link

@youngcw commented on GitHub (Jun 1, 2026):

I don't know what would be different. My instance has been upgraded from 26.5.2 to 26.6, just incrementally. That error looks like your server itself cant access simplefin. Have you tried restarting your server? Docker can randomly have networking troubles.

<!-- gh-comment-id:4595931524 --> @youngcw commented on GitHub (Jun 1, 2026): I don't know what would be different. My instance has been upgraded from 26.5.2 to 26.6, just incrementally. That error looks like your server itself cant access simplefin. Have you tried restarting your server? Docker can randomly have networking troubles.
GiteaMirror commented 2026-06-11 13:05:10 -05:00
Author
Owner
Copy Link

@KevinIsMyName commented on GitHub (Jun 1, 2026):

I'm not sure either. I have restarted the production instance and had no luck. I'm going to set up the dev envand see if I can get a good stack trace. This is the error from my production logs:

actual-server        | Error: Forbidden
actual-server        |     at getAccounts (file:///app/chunks/app-CLRswo4E.js:3998:37)
actual-server        |     at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
actual-server        |     at async file:///app/chunks/app-CLRswo4E.js:3760:20
actual-server        | 2026-06-01T19:48:04.673Z info: POST 200 /simplefin/accounts

Perhaps the existing accessKey isn't being reset with a new connection? Totally shooting in the dark here...

I'll report back with my findings soon

<!-- gh-comment-id:4596011771 --> @KevinIsMyName commented on GitHub (Jun 1, 2026): I'm not sure either. I have restarted the production instance and had no luck. I'm going to set up the dev envand see if I can get a good stack trace. This is the error from my production logs: ``` actual-server | Error: Forbidden actual-server | at getAccounts (file:///app/chunks/app-CLRswo4E.js:3998:37) actual-server | at process.processTicksAndRejections (node:internal/process/task_queues:103:5) actual-server | at async file:///app/chunks/app-CLRswo4E.js:3760:20 actual-server | 2026-06-01T19:48:04.673Z info: POST 200 /simplefin/accounts ``` Perhaps the existing accessKey isn't being reset with a new connection? Totally shooting in the dark here... I'll report back with my findings soon
GiteaMirror commented 2026-06-11 13:05:12 -05:00
Author
Owner
Copy Link

@matt-fidd commented on GitHub (Jun 1, 2026):

That looks like SimpleFIN returning 403 Forbidden, it would point towards an invalid token somewhere

<!-- gh-comment-id:4596031196 --> @matt-fidd commented on GitHub (Jun 1, 2026): That looks like SimpleFIN returning 403 Forbidden, it would point towards an invalid token somewhere
GiteaMirror commented 2026-06-11 13:05:12 -05:00
Author
Owner
Copy Link

@good-pm commented on GitHub (Jun 1, 2026):

For what it's worth, I'm experiencing the same issue on 26.6.0. I don't really know what I'm looking at in Dev Tools > Network but can provide that output if someone can point me to what's useful. Far as I can tell I get a {"status":"ok"} response as well.

I've created a new application in SimpleFIN, pasted the token into AB, but in SimpleFIN the token still shows as "Unclaimed" with a null Last Used date.

<!-- gh-comment-id:4596219409 --> @good-pm commented on GitHub (Jun 1, 2026): For what it's worth, I'm experiencing the same issue on 26.6.0. I don't really know what I'm looking at in Dev Tools > Network but can provide that output if someone can point me to what's useful. Far as I can tell I get a {"status":"ok"} response as well. I've created a new application in SimpleFIN, pasted the token into AB, but in SimpleFIN the token still shows as "Unclaimed" with a null Last Used date.
GiteaMirror commented 2026-06-11 13:05:12 -05:00
Author
Owner
Copy Link

@Juulz commented on GitHub (Jun 1, 2026):

I've been on nightly for a while. I'll update to latest and see what happens.

<!-- gh-comment-id:4596511520 --> @Juulz commented on GitHub (Jun 1, 2026): I've been on nightly for a while. I'll update to latest and see what happens.
GiteaMirror commented 2026-06-11 13:05:13 -05:00
Author
Owner
Copy Link

@Juulz commented on GitHub (Jun 1, 2026):

I've been on nightly for a while. I'll update to latest and see what happens.

It was a bit of a fight to get it to update ( I was on the newest nightly ), but after an import it was fine. SimpleFIN synced with no errors.

<!-- gh-comment-id:4596634480 --> @Juulz commented on GitHub (Jun 1, 2026): > I've been on nightly for a while. I'll update to latest and see what happens. It was a bit of a fight to get it to update ( I was on the newest nightly ), but after an import it was fine. SimpleFIN synced with no errors.
GiteaMirror commented 2026-06-11 13:05:14 -05:00
Author
Owner
Copy Link

@good-pm commented on GitHub (Jun 1, 2026):

Alright I got it to work by deleting the stale simplefin_accessKey from the db. After doing that, a new SimpleFIN token works as expected.

<!-- gh-comment-id:4596785591 --> @good-pm commented on GitHub (Jun 1, 2026): Alright I got it to work by deleting the stale simplefin_accessKey from the db. After doing that, a new SimpleFIN token works as expected.
GiteaMirror commented 2026-06-11 13:05:14 -05:00
Author
Owner
Copy Link

@KevinIsMyName commented on GitHub (Jun 1, 2026):

@good-pm , if you hit F12 or Ctrl + Shift + I, an extra window pane should pop out. You can also right-click on the page and look for Developer Tools > Inspect

OK, took me quite some digging. I found out my token was good, but my existing accessKey was bad and not being refreshed with the new token. You can reproduce this bug by going into the ../data/server-files/account.sqlite/ as root and setting the secrets.simplefin_accessKey to a bad value (e.g. set it to abc123). When you "Reset SimpleFIN credentials", it gives you this error, despite the API request successfully setting simplefin_token to null.

curl 'https://[MASKED]:5006/secret' \
  -H 'Referer: https://[MASKED]:5006/static/js/browser-server.Bn9r7T7W.js' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36' \
  -H 'DNT: 1' \
  -H 'Content-Type: application/json' \
  -H 'X-ACTUAL-TOKEN: 944fe034-07d9-4daf-9011-a2fd11d805a2' \
  --data-raw '{"name":"simplefin_token","value":null}'

{"status":"ok"}

Failed to reset SimpleFIN
Cannot read properties of undefined (reading 'error_code')

When you reset credentials, shouldn't it also set secrets.simplefin_accessKey to null?

Anyways, I fixed this by taking my token and manually creating my accessKey with the SimpleFIN protocol guide here. Then, I inserted both the token and accessKey into ../data/server-files/account.sqlite/. Now when I click "Link bank accounts", I see them!

<!-- gh-comment-id:4596857030 --> @KevinIsMyName commented on GitHub (Jun 1, 2026): @good-pm , if you hit F12 or Ctrl + Shift + I, an extra window pane should pop out. You can also right-click on the page and look for Developer Tools > Inspect OK, took me quite some digging. I found out my token was good, but my existing accessKey was bad and not being refreshed with the new token. You can reproduce this bug by going into the `../data/server-files/account.sqlite/` as root and setting the `secrets.simplefin_accessKey` to a bad value (e.g. set it to `abc123`). When you "Reset SimpleFIN credentials", it gives you this error, despite the API request successfully setting simplefin_token to null. ``` curl 'https://[MASKED]:5006/secret' \ -H 'Referer: https://[MASKED]:5006/static/js/browser-server.Bn9r7T7W.js' \ -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36' \ -H 'DNT: 1' \ -H 'Content-Type: application/json' \ -H 'X-ACTUAL-TOKEN: 944fe034-07d9-4daf-9011-a2fd11d805a2' \ --data-raw '{"name":"simplefin_token","value":null}' {"status":"ok"} ``` > Failed to reset SimpleFIN > Cannot read properties of undefined (reading 'error_code') **When you reset credentials, shouldn't it also set secrets.simplefin_accessKey to null?** Anyways, I fixed this by taking my token and manually creating my accessKey with the [SimpleFIN protocol guide here](https://www.simplefin.org/protocol.html). Then, I inserted both the token and accessKey into `../data/server-files/account.sqlite/`. Now when I click "Link bank accounts", I see them!
GiteaMirror commented 2026-06-11 13:05:15 -05:00
Author
Owner
Copy Link

@matt-fidd commented on GitHub (Jun 1, 2026):

Really odd that upgrading would trigger that, it sounds coincidental because I can't see why it would. I agree, we should probably reset the access key at the same time, but I'd need to dig into the code to see if there's a reason we didn't.

<!-- gh-comment-id:4597059961 --> @matt-fidd commented on GitHub (Jun 1, 2026): Really odd that upgrading would trigger that, it sounds coincidental because I can't see why it would. I agree, we should probably reset the access key at the same time, but I'd need to dig into the code to see if there's a reason we didn't.
GiteaMirror commented 2026-06-11 13:05:15 -05:00
Author
Owner
Copy Link

@good-pm commented on GitHub (Jun 1, 2026):

When you reset credentials, shouldn't it also set secrets.simplefin_accessKey to null?

That would be my expectation, too.

Anyways, I fixed this by taking my token and manually creating my accessKey with the SimpleFIN protocol guide here. Then, I inserted both the token and accessKey into ../data/server-files/account.sqlite/. Now when I click "Link bank accounts", I see them!

I just deleted the accessKey and loaded a new SimpleFIN token. Didn't have to manually create a new accessKey.

<!-- gh-comment-id:4597083390 --> @good-pm commented on GitHub (Jun 1, 2026): > **When you reset credentials, shouldn't it also set secrets.simplefin_accessKey to null?** > That would be my expectation, too. > Anyways, I fixed this by taking my token and manually creating my accessKey with the [SimpleFIN protocol guide here](https://www.simplefin.org/protocol.html). Then, I inserted both the token and accessKey into `../data/server-files/account.sqlite/`. Now when I click "Link bank accounts", I see them! I just deleted the accessKey and loaded a new SimpleFIN token. Didn't have to manually create a new accessKey.
GiteaMirror commented 2026-06-11 13:05:15 -05:00
Author
Owner
Copy Link

@KevinIsMyName commented on GitHub (Jun 1, 2026):

Actually, in the reset SimpleFIN credentials logic, it already sets both the token and then accessKey. However, ensureSuccessResponse() fails when resetting the token because that endpoint returns 200 with no error which throws the following error on the frontend:

Failed to reset SimpleFIN
Cannot read properties of undefined (reading 'error_code')

This error comes from this line, which then prevents the frontend from proceeding to reset the accessKey. A very naive solution is to parse as response?.foo instead of response.foo.

<!-- gh-comment-id:4597443444 --> @KevinIsMyName commented on GitHub (Jun 1, 2026): Actually, in the [reset SimpleFIN credentials logic](https://github.com/actualbudget/actual/blob/master/packages/desktop-client/src/components/banksync/useBuiltInBankSyncProviders.ts#L231-L244), it already sets both the token and then accessKey. However, `ensureSuccessResponse()` fails when resetting the token because that [endpoint returns 200 with no error](https://github.com/actualbudget/actual/blob/master/packages/sync-server/src/app-secrets.js#L67) which throws the following error on the frontend: > Failed to reset SimpleFIN > Cannot read properties of undefined (reading 'error_code') This error comes from [this line](https://github.com/actualbudget/actual/blob/master/packages/desktop-client/src/components/banksync/useBuiltInBankSyncProviders.ts#L80), which then prevents the frontend from proceeding to reset the accessKey. A very naive solution is to parse as `response?.foo` instead of `response.foo`.
GiteaMirror commented 2026-06-11 13:05:16 -05:00
Author
Owner
Copy Link

@bustedlawnchair commented on GitHub (Jun 3, 2026):

Just wanted to add a data point here. I am getting the same error mentioned earlier

actual-server | Error: Forbidden
actual-server | at getAccounts (file:///app/chunks/app-CLRswo4E.js:3998:37)
actual-server | at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
actual-server | at async file:///app/chunks/app-CLRswo4E.js:3760:20
actual-server | 2026-06-01T19:48:04.673Z info: POST 200 /simplefin/accounts

I had SimpleFIN configured then removed both my credentials in AB and the token in SimpleFIN. Now I am unable to link with a new token. I'm not sophisticated enough to make edits in the sqlite database like others have mentioned, but I just wanted to add my experience in the hope a future release will fix the bug.

<!-- gh-comment-id:4608726435 --> @bustedlawnchair commented on GitHub (Jun 3, 2026): Just wanted to add a data point here. I am getting the same error mentioned earlier > actual-server | Error: Forbidden actual-server | at getAccounts (file:///app/chunks/app-CLRswo4E.js:3998:37) actual-server | at process.processTicksAndRejections (node:internal/process/task_queues:103:5) actual-server | at async file:///app/chunks/app-CLRswo4E.js:3760:20 actual-server | 2026-06-01T19:48:04.673Z info: POST 200 /simplefin/accounts I had SimpleFIN configured then removed both my credentials in AB and the token in SimpleFIN. Now I am unable to link with a new token. I'm not sophisticated enough to make edits in the sqlite database like others have mentioned, but I just wanted to add my experience in the hope a future release will fix the bug.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bank sync bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#117645
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?