{"record":{"id":"5b2c0248c0cbbfbb","repo":"langflow-ai/langflow","slug":"api-key-required-for-this-project-provide-x-api-k","errorCode":null,"errorMessage":"API key required for this project. Provide x-api-key header or query parameter.","messagePattern":"API key required for this project\\. Provide x-api-key header or query parameter\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"src/backend/base/langflow/api/v1/mcp_projects.py","lineNumber":168,"sourceCode":"    # composer-to-Langflow hop should be authenticated explicitly once mcp-composer can forward\n    # a project-scoped backend credential; until then, direct backend access requires a key.\n    requires_api_key = (not auth_settings and not settings_service.auth_settings.AUTO_LOGIN) or (\n        project_auth_type in {\"apikey\", \"oauth\"}\n    )\n\n    if requires_api_key:\n        api_key = query_param or header_param\n        if not api_key:\n            if project_auth_type == \"oauth\":\n                detail = (\n                    \"This project is configured for OAuth authentication, but the MCP transport endpoint \"\n                    \"currently requires a valid x-api-key header or query parameter for backend access. \"\n                    \"Credential forwarding from MCP Composer is not yet available; use an API key in the \"\n                    \"meantime.\"\n                )\n            else:\n                detail = \"API key required for this project. Provide x-api-key header or query parameter.\"\n            raise HTTPException(\n                status_code=401,\n                detail=detail,\n            )\n\n        # Validate the API key\n        api_key_result = await authenticate_api_key(db, api_key)\n        if not api_key_result:\n            raise HTTPException(status_code=401, detail=\"Invalid API key\")\n        set_current_auth_context(AuthCredentialContext.from_api_key_result(api_key_result))\n        user = api_key_result.user\n\n        # Verify user has access to the project\n        project_access = (\n            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))\n        ).first()\n\n        if not project_access:\n            raise HTTPException(status_code=404, detail=\"Project not found\")","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/mcp_projects.py#L150-L186","documentation":"401 raised when the project's auth configuration requires an API key (project auth_type 'apikey'/'oauth', or no auth settings on a non-AUTO_LOGIN instance) but the request includes neither the x-api-key header nor the x-api-key query parameter. This is the non-oauth variant of the missing-credential branch — the detail string tells you exactly which credential channel to use.","triggerScenarios":"MCP transport request to a project requiring API keys with no x-api-key in headers or query; also unauthenticated requests when AUTO_LOGIN is false and the project has no auth_settings.","commonSituations":"Forgetting the API key in curl scripts or MCP client config; disabling AUTO_LOGIN after running open; clients sending Authorization: Bearer <jwt> to a transport endpoint that only accepts x-api-key.","solutions":["Add the API key: curl -H 'x-api-key: lf-...' .../api/v1/mcp/project/{id}/ or append ?x-api-key=lf-....","Generate a key for the project owner under Langflow Settings -> API Keys.","If this is a single-user local setup, LANGFLOW_AUTO_LOGIN=true removes the requirement (dev only).","Check the MCP client config supports custom headers and set x-api-key there."],"exampleFix":"# before\nresp = await client.get(f\"{base}/api/v1/mcp/project/{pid}/sse\")\n\n# after\nresp = await client.get(f\"{base}/api/v1/mcp/project/{pid}/sse\", headers={\"x-api-key\": api_key})","handlingStrategy":"validation","validationCode":"import os\n\ndef has_mcp_credential() -> bool:\n    return bool(os.environ.get('LANGFLOW_API_KEY'))","typeGuard":null,"tryCatchPattern":"except 401 'API key required': add x-api-key header and retry; do not retry unchanged.","preventionTips":["Configure x-api-key centrally in your MCP client so every request carries it.","Fail fast at client startup if no API key is configured for keyed projects."],"tags":["mcp","http-401","api-key","authentication","authorization"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}