Fixing the “Invalid Form Key. Please refresh the page.” Error in Magento 2

One of the most common Magento 2 errors store owners run into is:
“Invalid Form Key. Please refresh the page.”
You’ll usually see this when submitting a form (login, add to cart, checkout, admin forms, etc.), and it can hit your conversion rate hard if customers suddenly can’t add products to cart.

In this article we’ll walk through why this happens, how to quickly diagnose it, and a few production-safe fixes your development team can apply.

Why Magento 2 Throws the Invalid Form Key Error

Magento 2 uses a CSRF token called a form_key to make sure each form submission is coming from a valid session. If the token in the request doesn’t match what’s stored in the session, Magento blocks the action and shows the error.

Common causes include:

• Custom themes/templates missing <?= $block->getBlockHtml('formkey') ?>
• Long-living pages where the session expired before the user submitted the form
• Full-page caching or reverse proxies serving stale pages with old form keys
• AJAX or headless implementations that don’t send the form key along with the request

1. Make Sure Your Theme Outputs the Form Key

If you’ve customized templates, confirm that the form key block is present in every
POST form. For example, in a custom PHTML file:

<form action="<?= $block->getUrl('customer/account/loginPost') ?>" method="post">
    <?= $block->getBlockHtml('formkey') ?>

    <!-- your inputs here -->
    <input type="email" name="login[username]" />
    <input type="password" name="login[password]" />

    <button type="submit">Sign In</button>
</form>

If this line is missing, Magento will reject the request and display the “Invalid Form Key”
message.

2. Check for Stale Cache or Proxy Configuration

FPC or edge caches (Varnish, Cloudflare, custom Nginx caching) can accidentally cache
pages with an old form key. When a new user hits that cached page, the form key won’t match
their session.

Make sure sensitive pages are not cached or are using the correct cache configuration:

location ~* ^/(customer|checkout|sales)/ {
    # Don't cache account / checkout
    add_header X-Magento-NoCache 1;
}

In Varnish/Cloudflare, ensure checkout and account routes are bypassed or respect Magento’s
cache headers.

3. Debugging via var/log

Finally, check your logs for clues:

bin/magento cache:flush
tail -f var/log/exception.log var/log/system.log

If you see repeated invalid form key errors tied to a specific route or custom module,
you can narrow the fix to that template or controller instead of blindly changing global
settings.

Resolving the “Invalid Form Key” error is usually a mix of theme cleanup and cache hygiene.
Once your forms include a valid token and your edge cache respects Magento’s rules, this
error should disappear—and your customers can get back to checking out.