{"record":{"id":"44959bb676703c58","repo":"Zie619/n8n-workflows","slug":"reindexing-endpoint-is-disabled-set-admin-token-e","errorCode":null,"errorMessage":"Reindexing endpoint is disabled. Set ADMIN_TOKEN environment variable to enable.","messagePattern":"Reindexing endpoint is disabled\\. Set ADMIN_TOKEN environment variable to enable\\.","errorType":"http","errorClass":"HTTPException","httpStatus":503,"severity":"warning","filePath":"api_server.py","lineNumber":596,"sourceCode":"    admin_token: Optional[str] = Query(None, description=\"Admin authentication token\"),\n):\n    \"\"\"Trigger workflow reindexing in the background (requires authentication).\"\"\"\n    # Security: Rate limiting\n    client_ip = request.client.host if request.client else \"unknown\"\n    if not check_rate_limit(client_ip):\n        raise HTTPException(\n            status_code=429, detail=\"Rate limit exceeded. Please try again later.\"\n        )\n\n    # Security: Basic authentication check\n    # In production, use proper authentication (JWT, OAuth, etc.)\n    # For now, check for environment variable or disable endpoint\n\n    expected_token = os.environ.get(\"ADMIN_TOKEN\", None)\n\n    if not expected_token:\n        # If no token is configured, disable the endpoint for security\n        raise HTTPException(\n            status_code=503,\n            detail=\"Reindexing endpoint is disabled. Set ADMIN_TOKEN environment variable to enable.\",\n        )\n\n    if admin_token != expected_token:\n        print(f\"Security: Unauthorized reindex attempt from {client_ip}\")\n        raise HTTPException(status_code=401, detail=\"Invalid authentication token\")\n\n    def run_indexing():\n        try:\n            db.index_all_workflows(force_reindex=force)\n            print(f\"Reindexing completed successfully (requested by {client_ip})\")\n        except Exception as e:\n            print(f\"Error during reindexing: {e}\")\n\n    background_tasks.add_task(run_indexing)\n    return {\"message\": \"Reindexing started in background\", \"requested_by\": client_ip}\n","sourceCodeStart":578,"sourceCodeEnd":614,"githubUrl":"https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/api_server.py#L578-L614","documentation":"A 503 from POST /api/reindex raised when the ADMIN_TOKEN environment variable is not set on the server. The endpoint is deliberately disabled-by-default: without a configured token there is no way to authenticate the admin action, so the handler refuses with this message rather than allowing unauthenticated reindexing. It is a configuration state, not a transient failure — retrying without changes will always return 503.","triggerScenarios":"Any POST /api/reindex against a server launched without ADMIN_TOKEN in its environment (fresh clone, systemd unit missing the variable, container without the env var).","commonSituations":"New deployments where the operator never configured the token; env vars lost when switching from shell to service manager; .env file present but not loaded into the process environment.","solutions":["Set ADMIN_TOKEN in the server's environment (export ADMIN_TOKEN=... before uvicorn, or add it to the service/container env).","Restart the API process so it picks up the variable.","Retry as POST /api/reindex?admin_token=<token> (token is read from the query parameter).","Use a long random value and pass it over a trusted channel; the check is a direct equality comparison, not constant-time."],"exampleFix":"# before\nuvicorn api_server:app  # no ADMIN_TOKEN -> 503\n\n# after\nexport ADMIN_TOKEN=\"$(openssl rand -hex 32)\"\nuvicorn api_server:app\n# then: curl -X POST 'http://host/api/reindex?admin_token=<that value>'","handlingStrategy":"try-catch","validationCode":"import os, requests\n\ndef reindex_enabled(base):\n    # cheap probe: disabled endpoint answers 503 without side effects\n    r = requests.post(f'{base}/api/reindex')\n    return r.status_code != 503\n\n# or check your own server config before calling:\nassert os.environ.get('ADMIN_TOKEN'), 'Set ADMIN_TOKEN before enabling /api/reindex'","typeGuard":null,"tryCatchPattern":"try:\n    r = client.post(f'/api/reindex?admin_token={TOKEN}')\n    r.raise_for_status()\nexcept HTTPError as e:\n    if e.response.status_code == 503:\n        raise SystemExit('Reindex disabled: set ADMIN_TOKEN on the server and restart, then retry')\n    if e.response.status_code == 401:\n        raise SystemExit('Bad admin token')","preventionTips":["Set ADMIN_TOKEN in the deployment environment (service unit, container, .env loader) at provision time.","Restart the API after changing the environment.","Treat 503 from this route as a permanent config state — do not retry-loop it."],"tags":["fastapi","configuration","environment-variables","http-503","reindex","admin"],"backgroundTag":null,"analyzedSha":"94007c1445d9258a7da116646b79473e7c7c3282","analyzedAt":"2026-08-15T04:10:37.591Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}