{"record":{"id":"8887ab97d4910799","repo":"langflow-ai/langflow","slug":"this-project-is-configured-for-oauth-authenticatio","errorCode":null,"errorMessage":"This project is configured for OAuth authentication, but the MCP transport endpoint currently requires a valid x-api-key header or query parameter for backend access. Credential forwarding from MCP Composer is not yet available; use an API key in the meantime.","messagePattern":"This project is configured for OAuth authentication, but the MCP transport endpoint currently requires a valid x-api-key header or query parameter for backend access\\. Credential forwarding from MCP Composer is not yet available; use an API key in the meantime\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"src/backend/base/langflow/api/v1/mcp_projects.py","lineNumber":168,"sourceCode":"    # composer-to-Langflow hop should be authenticated explicitly once mcp-composer can forward\n    # a project-scoped backend credential; until then, direct backend access requires a key.\n    requires_api_key = (not auth_settings and not settings_service.auth_settings.AUTO_LOGIN) or (\n        project_auth_type in {\"apikey\", \"oauth\"}\n    )\n\n    if requires_api_key:\n        api_key = query_param or header_param\n        if not api_key:\n            if project_auth_type == \"oauth\":\n                detail = (\n                    \"This project is configured for OAuth authentication, but the MCP transport endpoint \"\n                    \"currently requires a valid x-api-key header or query parameter for backend access. \"\n                    \"Credential forwarding from MCP Composer is not yet available; use an API key in the \"\n                    \"meantime.\"\n                )\n            else:\n                detail = \"API key required for this project. Provide x-api-key header or query parameter.\"\n            raise HTTPException(\n                status_code=401,\n                detail=detail,\n            )\n\n        # Validate the API key\n        api_key_result = await authenticate_api_key(db, api_key)\n        if not api_key_result:\n            raise HTTPException(status_code=401, detail=\"Invalid API key\")\n        set_current_auth_context(AuthCredentialContext.from_api_key_result(api_key_result))\n        user = api_key_result.user\n\n        # Verify user has access to the project\n        project_access = (\n            await db.exec(select(Folder).where(Folder.id == project_id, Folder.user_id == user.id))\n        ).first()\n\n        if not project_access:\n            raise HTTPException(status_code=404, detail=\"Project not found\")","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/mcp_projects.py#L150-L186","documentation":"401 raised when an MCP transport request targets an OAuth-configured project but carries no x-api-key header or query parameter. Langflow cannot verify OAuth at the transport hop (network-level trust is unsafe, and MCP Composer credential forwarding is not yet implemented), so OAuth projects still require an API key for the backend transport until composer can forward a project-scoped credential.","triggerScenarios":"Calling /api/v1/mcp/project/{id}/ (or the conditional-auth endpoint) on a project with auth_type 'oauth' without an x-api-key header or ?x-api-key= query param and without a valid composer backend token.","commonSituations":"Assuming OAuth project = no API key needed for MCP; wiring MCP Composer without the backend token header; frontend-adjacent scripts calling the MCP endpoint with only a Bearer JWT when the project is oauth-typed.","solutions":["Supply a valid Langflow API key: header 'x-api-key: <key>' or query '?x-api-key=<key>' on the MCP transport requests.","If going through MCP Composer, ensure the composer backend auth token header is present and valid so the fast path applies.","Create an API key in Langflow (Settings -> API Keys) for the project owner if none exists.","Track/await composer credential forwarding support if you want passwordless OAuth-only MCP access."],"exampleFix":"# before\nawait client.get(f\"{base}/api/v1/mcp/project/{pid}/sse\")\n\n# after\nawait client.get(f\"{base}/api/v1/mcp/project/{pid}/sse\", headers={\"x-api-key\": LANGFLOW_API_KEY})","handlingStrategy":"validation","validationCode":"def mcp_transport_ready(project_auth_type: str, has_api_key: bool, has_composer_token: bool) -> bool:\n    if project_auth_type == 'oauth':\n        return has_api_key or has_composer_token\n    return True","typeGuard":null,"tryCatchPattern":"except 401 with 'OAuth' in detail: attach x-api-key and retry once; otherwise surface config error.","preventionTips":["For OAuth projects, always provision an API key for the transport hop.","Keep the composer backend token header configured when routing via MCP Composer."],"tags":["mcp","http-401","oauth","api-key","authentication"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}