FlowiseAI/Flowise · warning · InternalFlowiseError

Error: customMcpServersController.${endpoint} - invalid auth

Error message

Error: customMcpServersController.${endpoint} - invalid authType "${String(authType)}"

What it means

Thrown by assertValidAuthType when req.body.authType is defined but is not one of the allowed enum values ('NONE' or 'CUSTOM_HEADERS'). The guard skips when authType is undefined, so the error fires only when a client explicitly sent a wrong value. Returns HTTP 400 BAD_REQUEST.

Source

Thrown at packages/server/src/controllers/custom-mcp-servers/index.ts:16

import { NextFunction, Request, Response } from 'express'
import { StatusCodes } from 'http-status-codes'
import { InternalFlowiseError } from '../../errors/internalFlowiseError'
import { CustomMcpServerAuthType } from '../../Interface'
import customMcpServersService from '../../services/custom-mcp-servers'
import { getPageAndLimitParams } from '../../utils/pagination'

const MAX_PAGE_LIMIT = 500
const DEFAULT_PAGE = 1
const DEFAULT_LIMIT = 50

const assertValidAuthType = (authType: unknown, endpoint: string): void => {
    if (authType === undefined) return
    const allowed = Object.values(CustomMcpServerAuthType) as string[]
    if (typeof authType !== 'string' || !allowed.includes(authType)) {
        throw new InternalFlowiseError(
            StatusCodes.BAD_REQUEST,
            `Error: customMcpServersController.${endpoint} - invalid authType "${String(authType)}"`
        )
    }
}

const createCustomMcpServer = async (req: Request, res: Response, next: NextFunction) => {
    try {
        if (!req.body) {
            throw new InternalFlowiseError(
                StatusCodes.PRECONDITION_FAILED,
                `Error: customMcpServersController.createCustomMcpServer - body not provided!`
            )
        }
        const orgId = req.user?.activeOrganizationId
        if (!orgId) {
            throw new InternalFlowiseError(
                StatusCodes.NOT_FOUND,

View on GitHub (pinned to abe4a8601a)

Solutions

Set body.authType to exactly 'NONE' (when no auth needed) or 'CUSTOM_HEADERS' (when injecting auth headers via authConfig).
Omit authType entirely from the body if you want the default — assertValidAuthType returns early when authType === undefined.
Update your TypeScript client to use the CustomMcpServerAuthType enum rather than a string literal.
If you genuinely need a new auth scheme, extend CustomMcpServerAuthType in Interface.ts and the service layer; do not send an ad-hoc value.

Example fix

// before — wrong value & casing
{ name: 'my-mcp', serverUrl: '...', authType: 'Bearer' }

// after — valid enum value
import { CustomMcpServerAuthType } from '@flowise/interface'
{ name: 'my-mcp', serverUrl: '...', authType: CustomMcpServerAuthType.NONE }

Defensive patterns

Strategy: type-guard

Validate before calling

import { CustomMcpServerAuthType } from '@flowise/interface'

const ALLOWED = new Set<string>(Object.values(CustomMcpServerAuthType)) // {'NONE','CUSTOM_HEADERS'}

function normalizeAuthType(raw: unknown) {
  if (raw === undefined) return undefined // server allows omission
  if (typeof raw !== 'string' || !ALLOWED.has(raw)) {
    throw new Error(`authType must be one of ${[...ALLOWED].join('|')}, got ${String(raw)}`)
  }
  return raw
}

const body = { ...payload, authType: normalizeAuthType(payload.authType) }
await api.createCustomMcpServer(body)

Type guard

function isCustomMcpAuthType(v: unknown): v is CustomMcpServerAuthType {
  return typeof v === 'string'
    && Object.values(CustomMcpServerAuthType).includes(v as any)
}

Try / catch

try {
  await api.createCustomMcpServer(payload)
} catch (e) {
  if (e.status === 400 && /invalid authType/.test(e.message)) {
    // strip authType and retry with the default, or surface to the user
    const { authType, ...rest } = payload
    return api.createCustomMcpServer(rest)
  }
  throw e
}

Prevention

Import the CustomMcpServerAuthType enum on the client and reference its members instead of string literals.
Treat authType as optional — omit it rather than guessing, since assertValidAuthType allows undefined.
When the enum changes across versions, regenerate the client types from the server Interface.ts.

When it happens

Trigger: POST /api/v1/custom-mcp-servers or PUT /api/v1/custom-mcp-servers/:id with body.authType set to 'none', 'None', 'BASIC', 'BEARER', 'OAUTH2', or any string that isn't exactly 'NONE' or 'CUSTOM_HEADERS'. The check is case-sensitive and uses Object.values(CustomMcpServerAuthType).

Common situations: Client sends a lowercase or differently-cased value ('none' vs 'NONE'). Frontend built against an older or newer API version whose enum had different members. Hand-typed payload with a plausible-but-wrong auth scheme name. Migration from another MCP client that supports more auth types.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/39af9728841f9892. Report an issue: GitHub.