{"record":{"id":"835c1579f6af75e2","repo":"langflow-ai/langflow","slug":"custom-component-creation-is-disabled","errorCode":null,"errorMessage":"Custom component creation is disabled","messagePattern":"Custom component creation is disabled","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/endpoints.py","lineNumber":1382,"sourceCode":"                detail=\"Component templates are still initializing. Please try again in a few seconds.\",\n            )\n\n    # In admin-only mode, non-admin users may create/refresh only known server\n    # templates. Truly custom code creation remains restricted to administrators.\n    if (\n        getattr(settings, \"custom_component_admin_only\", False) is True\n        and not user.is_superuser\n        and not code_hash_matches_any_template(raw_code.code, all_known)\n    ):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Custom component creation is restricted to administrators\",\n        )\n\n    if not settings.allow_custom_components and not code_hash_matches_any_template(raw_code.code, all_known):\n        # Allow updating to a known server template (core component update),\n        # but block truly custom code.\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Custom component creation is disabled\",\n        )\n\n    # In restricted mode the request only reached here by matching a known\n    # template hash. That hash is a truncated digest, so a second-preimage\n    # collision could clear the gate with attacker-controlled bytes. Execute\n    # the server's trusted copy keyed by the same hash instead of the client\n    # bytes, and fail closed if no trusted source can be recovered.\n    effective_code = raw_code.code\n    if _requires_component_hash_lookups(settings, user):\n        effective_code = get_trusted_code_for_validation(raw_code.code)\n        if effective_code is None:\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail=\"Custom component creation is disabled\",\n            )\n","sourceCodeStart":1364,"sourceCodeEnd":1400,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/endpoints.py#L1364-L1400","documentation":"Error \"Custom component creation is disabled\" thrown in langflow-ai/langflow.","triggerScenarios":"Occurs when custom component creation is disabled by server configuration and a user attempts to create one.","commonSituations":"See trigger scenarios.","solutions":["Enable custom component creation in the server settings (LANGFLOW_ENABLE_CUSTOM_COMPONENT or equivalent)."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}