{"record":{"id":"3c2578473217a837","repo":"langflow-ai/langflow","slug":"invalid-api-key-3c2578","errorCode":null,"errorMessage":"Invalid API key","messagePattern":"Invalid API key","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"src/backend/base/langflow/api/v1/mcp_projects.py","lineNumber":176,"sourceCode":"        if not api_key:\n            if project_auth_type == \"oauth\":\n                detail = (\n                    \"This project is configured for OAuth authentication, but the MCP transport endpoint \"\n                    \"currently requires a valid x-api-key header or query parameter for backend access. \"\n                    \"Credential forwarding from MCP Composer is not yet available; use an API key in the \"\n                    \"meantime.\"\n                )\n            else:\n                detail = \"API key required for this project. Provide x-api-key header or query parameter.\"\n            raise HTTPException(\n                status_code=401,\n                detail=detail,\n            )\n\n        # Validate the API key\n        api_key_result = await authenticate_api_key(db, api_key)\n        if not api_key_result:\n            raise HTTPException(status_code=401, detail=\"Invalid API key\")\n        set_current_auth_context(AuthCredentialContext.from_api_key_result(api_key_result))\n        user = api_key_result.user\n\n        # Verify user has access to the project\n        project_access = (\n            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))\n        ).first()\n\n        if not project_access:\n            raise HTTPException(status_code=404, detail=\"Project not found\")\n\n        return user\n\n    # Legacy AUTO_LOGIN projects without explicit auth settings retain the\n    # existing single-user fallback. Explicit public projects returned their\n    # owner above and can never reach this system-superuser path.\n    return await _superuser_fallback(db, settings_service)\n","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/mcp_projects.py#L158-L194","documentation":"401 from the MCP project auth path: an x-api-key credential WAS provided but authenticate_api_key returned no result — the key does not exist, is inactive/expired, or is malformed. The credential channel is correct; the value is not.","triggerScenarios":"x-api-key header/query containing a deleted or revoked key, a truncated key (copy lost characters), a key from a different Langflow instance, or a placeholder like 'YOUR_API_KEY'.","commonSituations":"Key rotated/revoked after a leak; env-var with quotes/newlines included; copy-paste from logs that redacted part of the key; pointing at the wrong environment (dev key against prod).","solutions":["Create a fresh API key in Settings -> API Keys for the project owner and retry.","Verify the exact key value reached the request (no trailing whitespace/newline in the env var or header).","Confirm the key belongs to the same Langflow instance the MCP endpoint lives on.","If keys were rotated, update every client/config that stored the old one."],"exampleFix":"# before\napi_key = os.environ[\"LANGFLOW_API_KEY\"] + \"\\n\"  # stray newline -> invalid\n\n# after\napi_key = os.environ[\"LANGFLOW_API_KEY\"].strip()","handlingStrategy":"validation","validationCode":"import re\n# Langflow API keys look like 'lf-...' — sanity check shape and no stray whitespace\nAPI_KEY_RE = re.compile(r'^\\S+$')\ndef plausible_api_key(k: str) -> bool: return bool(k) and k == k.strip() and API_KEY_RE.match(k) is not None","typeGuard":null,"tryCatchPattern":"except 401 'Invalid API key': stop retrying, rotate the key, update config, then retry once with the new key.","preventionTips":["Strip env-sourced keys (.strip()) to avoid newline/space corruption.","After rotating keys, sweep all clients and CI secrets for the old value."],"tags":["mcp","http-401","api-key","authentication","credentials"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}