{"record":{"id":"5a5b96b4d2084e3f","repo":"langflow-ai/langflow","slug":"incorrect-username-or-password","errorCode":null,"errorMessage":"Incorrect username or password","messagePattern":"Incorrect username or password","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"warning","filePath":"src/backend/base/langflow/api/v1/login.py","lineNumber":101,"sourceCode":"            str(user.store_api_key),\n            httponly=auth_settings.ACCESS_HTTPONLY,\n            samesite=auth_settings.ACCESS_SAME_SITE,\n            secure=auth_settings.ACCESS_SECURE,\n            expires=None,  # Set to None to make it a session cookie\n            domain=auth_settings.COOKIE_DOMAIN,\n        )\n        await get_variable_service().initialize_user_variables(user.id, db)\n        # Initialize agentic variables if agentic experience is enabled\n        from langflow.api.utils.mcp.agentic_mcp import initialize_agentic_user_variables\n\n        # Create default project for user if it doesn't exist\n        _ = await get_or_create_default_folder(db, user.id)\n\n        if get_settings_service().settings.agentic_experience:\n            await initialize_agentic_user_variables(user.id, db)\n\n        return tokens\n    raise HTTPException(\n        status_code=status.HTTP_401_UNAUTHORIZED,\n        detail=\"Incorrect username or password\",\n        headers={\"WWW-Authenticate\": \"Bearer\"},\n    )\n\n\n@router.get(\"/auto_login\", include_in_schema=False)\nasync def auto_login(response: Response, db: DbSession):\n    auth_settings = get_settings_service().auth_settings\n\n    if auth_settings.AUTO_LOGIN:\n        auth = get_auth_service()\n        user_id, tokens = await auth.create_user_longterm_token(db)\n        # The auto-login token is now short-lived, so set the refresh\n        # cookie too — the client refreshes it transparently via /refresh instead\n        # of relying on a year-long token.\n        if tokens.get(\"refresh_token\"):\n            response.set_cookie(","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/login.py#L83-L119","documentation":"401 from POST /api/v1/login when authenticate_user returns no user — wrong username, wrong password, or the account cannot authenticate (e.g. inactive). It includes WWW-Authenticate: Bearer. This is the standard invalid-credentials response; server-side misfires produce 500 instead (see 449).","triggerScenarios":"POST /login with a mistyped username/password; account created but auto_login/auto-creation paths not triggered; password reset but client still using the old one.","commonSituations":"Stored credentials changed (env var LANGFLOW_SUPERUSER_PASSWORD rotated), first-login after fresh install where the user was never created, frontend sending form fields with wrong keys so username arrives empty.","solutions":["Verify the username exists and the password is current (superuser: check LANGFLOW_SUPERUSER_PASSWORD / langflow superuser)","Reset or recreate the user credential if forgotten","Confirm the client sends username/password as x-www-form-urlencoded form fields, not JSON"],"exampleFix":"# before: JSON body (wrong)\nrequests.post(url, json={\"username\": \"admin\", \"password\": \"x\"})\n\n# after: form-encoded\nrequests.post(url, data={\"username\": \"admin\", \"password\": \"x\"})","handlingStrategy":"validation","validationCode":"if not username or not password:\n    raise ValueError(\"credentials required\")\nresp = await client.post(\"/api/v1/login\", data={\"username\": username, \"password\": password})","typeGuard":null,"tryCatchPattern":"try:\n    await client.post(\"/api/v1/login\", data=form)\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 401:\n        show_error(\"Incorrect username or password\")  # do not retry blindly\n    raise","preventionTips":["Send credentials as x-www-form-urlencoded form data, not JSON","Verify the account exists and the password is current before automating logins","Rate-limit and backoff — do not hammer /login on 401"],"tags":["auth","login","http-401","credentials","langflow"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}