unable to login via immich cli using non-admin user api key

[milangm89]

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

• Yes

The bug

I am trying to bulk upload photos using the immich CLI for my sister's user. I have asked her to create the API key and provide me. She provided me the API key where she is a non admin user to the immich server.
When I try to login to immich cli, I am getting error below.

❯ immich login https://immich.mydomain.net/api 'xxxxx'  05:20:49 pm Logging in to https://immich.mydomain.net/api Failed to load user info - TypeError: fetch failed

Can someone help?

The OS that Immich Server is running on

docker inside truenas scale

Version of Immich Server

v1.131.3

Version of Immich Mobile App

v1.131.3

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

configs:
  permissions_actions_data:
    content: >-
      [{"mount_path": "/mnt/permission/pgvecto_postgres_data", "is_temporary":
      false, "identifier": "pgvecto_postgres_data", "recursive": false, "mode":
      "check", "uid": 999, "gid": 999, "chmod": null}, {"mount_path":
      "/mnt/permission/redis_redis_data", "is_temporary": true, "identifier":
      "redis_redis_data", "recursive": true, "mode": "check", "uid": 1001,
      "gid": 0, "chmod": null}]
  permissions_run_script:
    content: |
      #!/usr/bin/env python3

      import os
      import json
      import time
      import shutil

      with open("/script/actions.json", "r") as f:
          actions_data = json.load(f)

      if not actions_data:
          # If this script is called, there should be actions data
          raise ValueError("No actions data found")

      def fix_perms(path, chmod, recursive=False):
          print(f"Changing permissions{' recursively ' if recursive else ' '}to {chmod} on: [{path}]")
          os.chmod(path, int(chmod, 8))
          if recursive:
              for root, dirs, files in os.walk(path):
                  for f in files:
                      os.chmod(os.path.join(root, f), int(chmod, 8))
          print("Permissions after changes:")
          print_chmod_stat()

      def fix_owner(path, uid, gid, recursive=False):
          print(f"Changing ownership{' recursively ' if recursive else ' '}to {uid}:{gid} on: [{path}]")
          os.chown(path, uid, gid)
          if recursive:
              for root, dirs, files in os.walk(path):
                  for f in files:
                      os.chown(os.path.join(root, f), uid, gid)
          print("Ownership after changes:")
          print_chown_stat()

      def print_chown_stat():
          curr_stat = os.stat(action["mount_path"])
          print(f"Ownership: [{curr_stat.st_uid}:{curr_stat.st_gid}]")

      def print_chmod_stat():
          curr_stat = os.stat(action["mount_path"])
          print(f"Permissions: [{oct(curr_stat.st_mode)[3:]}]")

      def print_chown_diff(curr_stat, uid, gid):
          print(f"Ownership: wanted [{uid}:{gid}], got [{curr_stat.st_uid}:{curr_stat.st_gid}].")

      def print_chmod_diff(curr_stat, mode):
          print(f"Permissions: wanted [{mode}], got [{oct(curr_stat.st_mode)[3:]}].")

      def perform_action(action):
          start_time = time.time()
          print(f"=== Applying configuration on volume with identifier [{action['identifier']}] ===")

          if not os.path.isdir(action["mount_path"]):
              print(f"Path [{action['mount_path']}] is not a directory, skipping...")
              return

          if action["is_temporary"]:
              print(f"Path [{action['mount_path']}] is a temporary directory, ensuring it is empty...")
              for item in os.listdir(action["mount_path"]):
                  item_path = os.path.join(action["mount_path"], item)

                  # Exclude the safe directory, where we can use to mount files temporarily
                  if os.path.basename(item_path) == "ix-safe":
                      continue
                  if os.path.isdir(item_path):
                      shutil.rmtree(item_path)
                  else:
                      os.remove(item_path)

          if not action["is_temporary"] and os.listdir(action["mount_path"]):
              print(f"Path [{action['mount_path']}] is not empty, skipping...")
              return

          print(f"Current Ownership and Permissions on [{action['mount_path']}]:")
          curr_stat = os.stat(action["mount_path"])
          print_chown_diff(curr_stat, action["uid"], action["gid"])
          print_chmod_diff(curr_stat, action["chmod"])
          print("---")

          if action["mode"] == "always":
              fix_owner(action["mount_path"], action["uid"], action["gid"], action["recursive"])
              if not action["chmod"]:
                  print("Skipping permissions check, chmod is falsy")
              else:
                  fix_perms(action["mount_path"], action["chmod"], action["recursive"])
              return

          elif action["mode"] == "check":
              if curr_stat.st_uid != action["uid"] or curr_stat.st_gid != action["gid"]:
                  print("Ownership is incorrect. Fixing...")
                  fix_owner(action["mount_path"], action["uid"], action["gid"], action["recursive"])
              else:
                  print("Ownership is correct. Skipping...")

              if not action["chmod"]:
                  print("Skipping permissions check, chmod is falsy")
              else:
                  if oct(curr_stat.st_mode)[3:] != action["chmod"]:
                      print("Permissions are incorrect. Fixing...")
                      fix_perms(action["mount_path"], action["chmod"], action["recursive"])
                  else:
                      print("Permissions are correct. Skipping...")

          print(f"Time taken: {(time.time() - start_time) * 1000:.2f}ms")
          print(f"=== Finished applying configuration on volume with identifier [{action['identifier']}] ==")
          print()

      if __name__ == "__main__":
          start_time = time.time()
          for action in actions_data:
              perform_action(action)
          print(f"Total time taken: {(time.time() - start_time) * 1000:.2f}ms")
services:
  machine-learning:
    cap_drop:
      - ALL
    depends_on:
      permissions:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4096M
    environment:
      IMMICH_LOG_LEVEL: log
      IMMICH_PORT: '32002'
      MACHINE_LEARNING_CACHE_FOLDER: /mlcache
      NODE_ENV: production
      NVIDIA_VISIBLE_DEVICES: void
      TRANSFORMERS_CACHE: /mlcache
      TZ: Europe/London
      UMASK: '002'
      UMASK_SET: '002'
    group_add:
      - 568
    healthcheck:
      interval: 10s
      retries: 30
      start_period: 10s
      test: python3 /usr/src/app/healthcheck.py
      timeout: 5s
    image: 'ghcr.io/immich-app/immich-machine-learning:v1.130.2'
    platform: linux/amd64
    privileged: false
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    stdin_open: false
    tty: false
    volumes:
      - read_only: false
        target: /mlcache
        type: volume
        volume:
          nocopy: false
  permissions:
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
    cap_drop:
      - ALL
    configs:
      - mode: 320
        source: permissions_actions_data
        target: /script/actions.json
      - mode: 448
        source: permissions_run_script
        target: /script/run.py
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1024M
    entrypoint:
      - python3
      - /script/run.py
    environment:
      NVIDIA_VISIBLE_DEVICES: void
      TZ: Europe/London
      UMASK: '002'
      UMASK_SET: '002'
    group_add:
      - 568
    healthcheck:
      disable: true
    image: 'python:3.13.0-slim-bookworm'
    network_mode: none
    platform: linux/amd64
    privileged: false
    restart: 'on-failure:1'
    security_opt:
      - no-new-privileges=true
    stdin_open: false
    tty: false
    user: '0:0'
    volumes:
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/postgres
        target: /mnt/permission/pgvecto_postgres_data
        type: bind
      - read_only: false
        source: redis-data
        target: /mnt/permission/redis_redis_data
        type: volume
        volume:
          nocopy: false
  pgvecto:
    cap_drop:
      - ALL
    depends_on:
      permissions:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4096M
    environment:
      NVIDIA_VISIBLE_DEVICES: void
      POSTGRES_DB: immich
      POSTGRES_PASSWORD:
      POSTGRES_PORT: '5432'
      POSTGRES_USER: immich
      TZ: Europe/London
      UMASK: '002'
      UMASK_SET: '002'
    group_add:
      - 568
    healthcheck:
      interval: 10s
      retries: 30
      start_period: 10s
      test: pg_isready -h 127.0.0.1 -p 5432 -U $$POSTGRES_USER -d $$POSTGRES_DB
      timeout: 5s
    image: 'tensorchord/pgvecto-rs:pg15-v0.2.0'
    platform: linux/amd64
    privileged: false
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    stdin_open: false
    tty: false
    user: '999:999'
    volumes:
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/postgres
        target: /var/lib/postgresql/data
        type: bind
  redis:
    cap_drop:
      - ALL
    depends_on:
      permissions:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4096M
    environment:
      ALLOW_EMPTY_PASSWORD: 'no'
      NVIDIA_VISIBLE_DEVICES: void
      REDIS_PASSWORD:
      REDIS_PORT_NUMBER: '6379'
      TZ: Europe/London
      UMASK: '002'
      UMASK_SET: '002'
    group_add:
      - 568
    healthcheck:
      interval: 10s
      retries: 30
      start_period: 10s
      test: redis-cli -h 127.0.0.1 -p 6379 -a $$REDIS_PASSWORD ping | grep -q PONG
      timeout: 5s
    image: 'bitnami/redis:7.4.2'
    platform: linux/amd64
    privileged: false
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    stdin_open: false
    tty: false
    user: 60060
    volumes:
      - read_only: false
        source: redis-data
        target: /bitnami/redis/data
        type: volume
        volume:
          nocopy: false
  server:
    cap_drop:
      - ALL
    depends_on:
      machine-learning:
        condition: service_healthy
      permissions:
        condition: service_completed_successfully
      pgvecto:
        condition: service_healthy
      redis:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4096M
    environment:
      DB_DATABASE_NAME: immich
      DB_HOSTNAME: pgvecto
      DB_PASSWORD:
      DB_PORT: '5432'
      DB_USERNAME: immich
      IMMICH_LOG_LEVEL: log
      IMMICH_MACHINE_LEARNING_ENABLED: 'true'
      IMMICH_MACHINE_LEARNING_URL: 'http://machine-learning:32002'
      IMMICH_PORT: '30041'
      NODE_ENV: production
      NVIDIA_VISIBLE_DEVICES: void
      REDIS_DBINDEX: '0'
      REDIS_HOSTNAME: redis
      REDIS_PASSWORD:
      REDIS_PORT: '6379'
      TZ: Europe/London
      UMASK: '002'
      UMASK_SET: '002'
    group_add:
      - 568
    healthcheck:
      interval: 10s
      retries: 30
      start_period: 10s
      test: /usr/src/app/bin/immich-healthcheck
      timeout: 5s
    image: 'ghcr.io/immich-app/immich-server:v1.130.2'
    platform: linux/amd64
    ports:
      - mode: ingress
        protocol: tcp
        published: 30041
        target: 30041
    privileged: false
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    stdin_open: false
    tty: false
    volumes:
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/backups
        target: /usr/src/app/upload/backups
        type: bind
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/video
        target: /usr/src/app/upload/encoded-video
        type: bind
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/library
        target: /usr/src/app/upload/library
        type: bind
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/profile
        target: /usr/src/app/upload/profile
        type: bind
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/thumbs
        target: /usr/src/app/upload/thumbs
        type: bind
      - bind:
          create_host_path: false
          propagation: rprivate
        read_only: false
        source: /mnt/immich/uploads
        target: /usr/src/app/upload/upload
        type: bind
volumes:
  redis-data: {}
x-notes: >+
  # Immich


  ## Bug Reports and Feature Requests


  If you find a bug in this app or have an idea for a new feature, please file
  an issue at

  https://github.com/truenas/apps

x-portals:
  - host: 0.0.0.0
    name: Web UI
    path: /
    port: 30041
    scheme: http

Your .env content

its there in the docker-compose file ˆˆ

Reproduction steps

1. try the command "immich login https://immich.domain.net/api 'xxxxxxx' where the API key is created under a non admin user
2. it will throw error below
   +++
   Logging in to https://immich.domain.net/api
   Failed to load user info - TypeError: fetch failed
   +++

Relevant log output

user login successful

Additional information

No response

[bo0tzz]

You call out the "non admin" piece exclusively - does it work with an admin API key? There's not a lot of info here but I can't imagine the user permission making a difference, this seems like a plain networking issue to me.

[milangm89]

@bo0tzz Just checked now and it is not working with admin user API as well. How to fix it? I cant find any network issues here. Any way to check it in detail?

[bo0tzz]

You'll want to do the usual network troubleshooting; this doesn't seem like an Immich-specific issue to me.

[milangm89]

It's not a network issue at all. and the API endpoint is working as well. please see the below curl output.

+++
curl https://immichxxxx.nett/api/server/ping 01:14:55 pm
{"res":"pong"}%
+++

I can't find any debugging option for Immich CLI to trace it as well. Please help.

[bo0tzz]

What version of the Immich CLI are you using? From where are you running this? Does bypassing your reverse proxy make any difference?

[milangm89]

Hi @bo0tzz

❯ immich -V 03:20:01 pm
2.2.61

From where are you running this?

I am running from my MacBook and immich is hosted in my truenas in my local network. i tried both reverse proxy URL as well as the direct IP:port URL as well. please see the snippet below.
+++
❯ immich login-key http://192.168.51.158:30041/api xxxxx
Logging in to http://192.168.51.158:30041/api
Failed to load user info - TypeError: fetch failed
+++

no difference in calling it via IP URL as well (http://192.168.51.158:30041/)
Another thing noticed is it is not working with Immich-Go CLI as well. For that, I am getting a similar error as well.
++++
immich-go upload from-folder motorola_edge_40_neo --server http://192.168.51.158:30041/ --api-key xxxxxx
. _ _ _ _ . | _ _
|| | || | ||(| | ─ (|(_)
v 0.25.0 _)

Log file: /Users/xxxx/Library/Caches/immich-go/immich-go_2025-04-10_15-20-01.log
Error: unexpected response to the immich's ping API at this address: http://192.168.51.158:30041/api/server/ping:

unexpected response to the immich's ping API at this address: http://192.168.51.158:30041/api/server/ping:
+++

Seems like the URL response has changed or it is expecting something different.
Please help.