FlowiseAI/Flowise · error · Error

Invalid app slug format. Must be lowercase letters, digits,

Error message

Invalid app slug format. Must be lowercase letters, digits, hyphens and underscores only.

What it means

Thrown when the appSlug is present but fails the SLUG_PATTERN regex (lowercase letters/digits, hyphens, underscores; allows comma-separated lists). This guards the x-pd-app-slug header against injection and malformed values before the request is sent.

Source

Thrown at packages/components/nodes/tools/MCP/Pipedream/PipedreamMCP.ts:266

        const databaseEntities = options.databaseEntities as IDatabaseEntity
        const optionsWithWorkspaceId = options.workspaceId ? options : { ...options, workspaceId }
        const variables = await getVars(appDataSource, databaseEntities, nodeData, optionsWithWorkspaceId)
        const vars = prepareSandboxVars(variables) as Record<string, string>

        return value.replace(VAR_PLACEHOLDER_RE, (match, varName) => {
            return vars[varName] != null ? String(vars[varName]) : match
        })
    }

    async getTools(nodeData: INodeData, options: ICommonObject, isLoadMethod = false): Promise<Tool[]> {
        const appSlug = nodeData.inputs?.appSlug as string
        if (!appSlug) {
            throw new Error('Pipedream app slug is required')
        }

        const SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9_-]{0,98}[a-z0-9])?(?:,\s*[a-z0-9](?:[a-z0-9_-]{0,98}[a-z0-9])?)*$/
        if (!SLUG_PATTERN.test(appSlug)) {
            throw new Error('Invalid app slug format. Must be lowercase letters, digits, hyphens and underscores only.')
        }

        let externalUserId = nodeData.inputs?.externalUserId as string
        externalUserId = await this.resolveVarsInString(externalUserId, nodeData, options)

        if (externalUserId.includes('{{')) {
            if (!isLoadMethod) {
                throw new Error(
                    'Variables in User ID are not resolved. ' +
                        '{{$vars.*}} requires a matching workspace variable. ' +
                        '{{$flow.*}} variables (e.g. sessionId) are only available at runtime, not when refreshing actions.'
                )
            }
            // For loadMethods context, use a sanitized fallback so tool listing still works.
            // The actual externalUserId will be resolved at runtime.
            externalUserId = 'flowise_preview_user'
        }

View on GitHub (pinned to abe4a8601a)

Solutions

  1. Lowercase the slug and remove spaces: use the exact identifier from Pipedream's app directory.
  2. For multiple apps, comma-separate valid slugs without spaces after commas is tolerated but keep each entry clean.
  3. If the value comes from a variable, sanitize/normalize it before it reaches the node input.

Example fix

// before: appSlug = 'Slack App'
// after:  appSlug = 'slack'
Defensive patterns

Strategy: validation

Validate before calling

const SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9_-]{0,98}[a-z0-9])?(?:,\s*[a-z0-9](?:[a-z0-9_-]{0,98}[a-z0-9])?)*$/
const appSlug = (nodeData.inputs?.appSlug as string || '').trim().toLowerCase()
if (!SLUG_PATTERN.test(appSlug)) {
    throw new Error('Invalid app slug format')
}

Type guard

function isValidPipedreamSlug(slug: string): boolean {
    return /^[a-z0-9](?:[a-z0-9_-]{0,98}[a-z0-9])?(?:,\s*[a-z0-9](?:[a-z0-9_-]{0,98}[a-z0-9])?)*$/.test(slug)
}

Try / catch

try { await pipedream.getTools(nodeData, options) }
catch (e) { if (e instanceof Error && e.message.startsWith('Invalid app slug format')) { /* normalize the input */ } }

Prevention

When it happens

Trigger: appSlug contains uppercase letters, spaces, special characters, slashes, or shell metacharacters; a multi-slug list with a bad entry; user pasted a full URL or app name instead of the slug.

Common situations: User typed 'Slack' (uppercase) instead of 'slack'; pasted 'https://...' or a display name; used a comma list like 'slack, github' where one entry has a space; template injection introduced a bad character.

Related errors


AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/414fd40d84ee9f94. Report an issue: GitHub.