I'm running ONLYOFFICE Document Server under an https:// vhost on nginx on Ubuntu Server 18.04 LTS. It's reachable at onlyoffice.example.com and I also have a Nextcloud instance at nextcloud.example.com that it integrates with.

To prevent unauthorised access to my server, I used to have a JWT authentication key inside my /etc/onlyoffice/documentserver/default.json file for browser, inbox, outbox and session strings. After updating to version 5.2.0, I had to reset my default.json file to default (from the GitHub repository) as ONLYOFFICE would not work otherwise for some reason (?), and then I set my PostgreSQL DB password correctly as well as the four key strings (all equal) mentioned above.

I also ensured that secret key authentication was set on true for all three options (browser, inbox and outbox).

Then I ran:

#: supervisorctl restart all
#: systemctl restart nginx

and successfully restarted my webserver and ONLYOFFICE.

When I go into Nextcloud ONLYOFFICE settings, with no key entered my instance works perfectly. If instead I specify any secret key (including the correct very one), it gives me the following error

Error when trying to connect (Error occurred in the document service: Error while downloading the document file to be converted.)

It's worth nothing that this way there is no security at all, and anyone can use my ONLYOFFICE Document Server for free on their systems.

Here's a screenshot of the relevant part (starting at line 132) of my /etc/onlyoffice/documentserver/default.json file (where the red X is, I covered my secret key in Snipping Tool for privacy).

/etc/onlyoffice/documentserver/default.json file open in VIM

1 Answer 1


After additional tests, I tried to intentionally replace the database password in the default.json file with a wrong one, and to my great surprise, ONLYOFFICE still worked! I even deleted important entries, and ONLYOFFICE didn't bat an eye.
This meant that ONLYOFFICE was looking at another config file. I did:

root@server:/# ls /etc/onlyoffice/documentserver

and I discovered that there are several other config files after the update to 5.2:

default.json            development-mac.json      log4js     production-linux.json
default.json.dpkg-dist  development-windows.json  logrotate  production-windows.json
default.json.old        local.json                nginx      supervisor

I inspected the different config files and it looks like local.json contains my correct PostgreSQL configuration, the default "secret" keys and minimal options for enabling/disabling them. It's a 44-line long file, vs the 241 lines in default.json.
I correctly configured my local.json file and finally, Nextcloud gave me a token error. I updated secret key info in Nextcloud ONLYOFFICE settings and now JWS authentication is working properly!


A poorly documented change with ONLYOFFICE version 5.2.0 consists in the config file no longer being /etc/onlyoffice/documentserver/default.json, but now rather /etc/onlyoffice/documentserver/local.json. Hence, to modify ONLYOFFICE configuration, the file to edit now is /etc/onlyoffice/documentserver/local.json.

  • 1
    You are right mate. Thank you! Token must be copied from local.json to nextcloud and local.json header name musts be fixed to Authorization to make this compatible to nextcloud requests. Nov 4, 2018 at 19:52
  • @КлаусШварц You're welcome, glad this helped. By the way, I also noticed that the secret key is being reset with updates. Weird...
    – Manchineel
    Nov 5, 2018 at 14:39
  • It turns out that my fixture breaks DocumentServer integration with CommunityServer integration ^_^ I will try to understand what went wrong and post it here. Nov 7, 2018 at 10:39
  • @КлаусШварц With every update, the local.json file keeps getting reset to no secret token authentication, so I have to edit/update the file at each upgrade of the onlyoffice-documentserver package. Is the same happening for you?
    – Manchineel
    Feb 7, 2019 at 18:30
  • Didn't try to update Document Server since first installation in November :) Did you report this bug? Feb 21, 2019 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.