{"record":{"id":"178767514ded5032","repo":"langflow-ai/langflow","slug":"missing-superuser-username-in-auth-settings","errorCode":null,"errorMessage":"Missing superuser username in auth settings","messagePattern":"Missing superuser username in auth settings","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/backend/base/langflow/api/v1/mcp_projects.py","lineNumber":199,"sourceCode":"        project_access = (\n            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))\n        ).first()\n\n        if not project_access:\n            raise HTTPException(status_code=404, detail=\"Project not found\")\n\n        return user\n\n    # Legacy AUTO_LOGIN projects without explicit auth settings retain the\n    # existing single-user fallback. Explicit public projects returned their\n    # owner above and can never reach this system-superuser path.\n    return await _superuser_fallback(db, settings_service)\n\n\nasync def _superuser_fallback(db: AsyncSession, settings_service) -> User:\n    \"\"\"Resolve the configured superuser for unauthenticated MCP paths that allow fallback.\"\"\"\n    if not settings_service.auth_settings.SUPERUSER:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=\"Missing superuser username in auth settings\",\n        )\n    result = await get_user_by_username(db, settings_service.auth_settings.SUPERUSER)\n    if result:\n        logger.warning(AUTO_LOGIN_WARNING)\n        set_current_auth_context(AuthCredentialContext(method=AUTH_METHOD_AUTO_LOGIN))\n        return result\n    raise HTTPException(\n        status_code=status.HTTP_403_FORBIDDEN,\n        detail=\"Invalid user\",\n    )\n\n\n# Smart authentication dependency that chooses method based on project settings\nasync def verify_project_auth_conditional(\n    project_id: UUID,\n    request: Request,","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/mcp_projects.py#L181-L217","documentation":"400 raised by _superuser_fallback: the request reached the unauthenticated AUTO_LOGIN-era path (project has no auth settings and AUTO_LOGIN is enabled), which resolves the configured superuser — but settings_service.auth_settings.SUPERUSER is empty. Without a superuser name there is no principal to run the MCP tools as, so the request is rejected as a misconfiguration rather than silently denied.","triggerScenarios":"AUTO_LOGIN=true with no SUPERUSER configured (env LANGFLOW_SUPERUSER unset), and an MCP project request that falls through to the legacy fallback (folder without auth_settings).","commonSituations":"Fresh installs that enabled auto-login but never ran superuser creation; docker/k8s deployments missing the LANGFLOW_SUPERUSER env var; disabling the superuser after setup while keeping AUTO_LOGIN on.","solutions":["Set the superuser username (env LANGFLOW_SUPERUSER=<name>) on the Langflow instance and restart.","Create that user if it does not exist (langflow superuser command or first-run setup).","Preferably: give the project explicit auth_settings (apikey/none) so requests stop depending on the superuser fallback.","Or turn AUTO_LOGIN off and use per-project API keys."],"exampleFix":"# before (docker run)\ndocker run -e LANGFLOW_AUTO_LOGIN=true ... langflow\n\n# after\ndocker run -e LANGFLOW_AUTO_LOGIN=true -e LANGFLOW_SUPERUSER=admin ... langflow","handlingStrategy":"validation","validationCode":"import os\n\ndef auto_login_fallback_configured(auto_login: bool, superuser: str | None) -> bool:\n    return not auto_login or bool(superuser)  # fallback path needs SUPERUSER set","typeGuard":null,"tryCatchPattern":"except 400 'Missing superuser username': fix instance env (LANGFLOW_SUPERUSER) and restart; not a client retry case.","preventionTips":["Always set LANGFLOW_SUPERUSER when enabling AUTO_LOGIN.","Prefer explicit per-project auth over the legacy fallback."],"tags":["mcp","http-400","configuration","superuser","auto-login"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}