FlowiseAI/Flowise · error · InternalFlowiseError

Error: chatflowsController.setWebhookSecret - workspace not

Error message

Error: chatflowsController.setWebhookSecret - workspace not found!

What it means

Thrown by setWebhookSecret when req.user?.activeWorkspaceId is falsy. Notably this guard returns UNAUTHORIZED (401), unlike most other workspace checks in the file which return NOT_FOUND (404) — an inconsistency to be aware of when mapping status codes to causes. The webhook secret is workspace-scoped, so the operation cannot proceed without a workspace.

Source

Thrown at packages/server/src/controllers/chatflows/index.ts:312

        }
        const apiResponse = await chatflowsService.checkIfChatflowHasChanged(req.params.id, req.params.lastUpdatedDateTime, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const setWebhookSecret = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (!req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: chatflowsController.setWebhookSecret - id not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {
            throw new InternalFlowiseError(StatusCodes.UNAUTHORIZED, `Error: chatflowsController.setWebhookSecret - workspace not found!`)
        }
        const apiResponse = await chatflowsService.setWebhookSecret(req.params.id, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
        next(error)
    }
}

const clearWebhookSecret = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (!req.params.id) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: chatflowsController.clearWebhookSecret - id not provided!`
            )
        }
        const workspaceId = req.user?.activeWorkspaceId
        if (!workspaceId) {

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Send a valid authenticated request (session cookie or API key) so req.user.activeWorkspaceId is populated.
  2. Verify the user has an active workspace assigned; switch/create one if not.
  3. Check the route is wired behind the same auth middleware used by other chatflow endpoints.

Example fix

// before
await fetch(`/api/v1/chatflows/${id}/webhook-secret`, { method: 'POST' })
// after
await fetch(`/api/v1/chatflows/${id}/webhook-secret`, {
  method: 'POST',
  headers: { Authorization: `Bearer ${apiKey}` }
})
Defensive patterns

Strategy: validation

Validate before calling

async function authedFetch(url: string, init: RequestInit) {
  if (!token) throw new Error('no auth token - cannot resolve active workspace')
  return fetch(url, { ...init, headers: { ...init.headers, Authorization: `Bearer ${token}` } })
}

Type guard

const hasActiveWorkspace = (u: unknown): u is { activeWorkspaceId: string } =>
  !!u && typeof (u as any).activeWorkspaceId === 'string'

Try / catch

try { await api.setWebhookSecret(id) } catch (e) { if (e.statusCode === 401) { await reAuth(); await api.setWebhookSecret(id) } else throw e }

Prevention

When it happens

Trigger: The request lacks an authenticated user context (no req.user) or the user has no activeWorkspaceId. Commonly seen when the endpoint is hit without a valid session/API key, or when auth middleware is skipped on the route.

Common situations: Missing/expired auth token, a reverse proxy stripping session cookies, an API key that does not resolve to a workspace, or a shared client reused after logout.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/615610e36d8de5e8. Report an issue: GitHub.