{"record":{"id":"a4cf7af1cd19dd95","repo":"payloadcms/payload","slug":"error-notallowedtoperformaction-a4cf7a","errorCode":null,"errorMessage":"error:notAllowedToPerformAction","messagePattern":"error:notAllowedToPerformAction","errorType":"exception","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/auth/operations/registerFirstUser.ts","lineNumber":47,"sourceCode":"\nexport const registerFirstUserOperation = async <TSlug extends AuthCollectionSlug>(\n  args: Arguments<TSlug>,\n): Promise<Result<DataFromCollectionSlug<TSlug>>> => {\n  const {\n    collection: {\n      config,\n      config: {\n        slug,\n        auth: { verify },\n      },\n    },\n    data,\n    req,\n    req: { payload },\n  } = args\n\n  if (config.auth.disableLocalStrategy) {\n    throw new Forbidden(req.t)\n  }\n\n  try {\n    const shouldCommit = await initTransaction(req)\n\n    ensureUsernameOrEmail<TSlug>({\n      authOptions: config.auth,\n      collectionSlug: slug,\n      data,\n      operation: 'create',\n      req,\n    })\n\n    const where = appendNonTrashedFilter({\n      enableTrash: Boolean(config.trash),\n      trash: false,\n      where: {}, // no initial filter; just exclude trashed docs\n    })","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/auth/operations/registerFirstUser.ts#L29-L65","documentation":"Thrown at the top of `registerFirstUser` when `config.auth.disableLocalStrategy` is true. This collection delegates authentication to an external/SSO/JWT strategy, so Payload refuses to create a first local user. `Forbidden` (HTTP 403).","triggerScenarios":"A collection is configured with `auth: { disableLocalStrategy: true }` (e.g. delegating to a third-party IdP) and the first-user registration endpoint is hit. The operation exists only for local-strategy bootstrapping, so it bails immediately.","commonSituations":"A boilerplate/template that always calls `registerFirstUser` on setup, applied to a collection configured for SSO; mislabeling a collection as auth-enabled-for-external; enabling `disableLocalStrategy` without removing the first-user seeding script.","solutions":["Remove the `registerFirstUser` call for collections with `disableLocalStrategy: true`; create the initial user through your external IdP instead.","If you actually want local users, set `disableLocalStrategy: false` (or omit it).","Guard the seeding step: `if (!config.auth.disableLocalStrategy) await payload.registerFirstUser(...)`."],"exampleFix":"// before\nawait payload.registerFirstUser({ collection: 'users', data, req })\n// after\nif (!collectionConfig.auth.disableLocalStrategy) {\n  await payload.registerFirstUser({ collection: 'users', data, req })\n}","handlingStrategy":"validation","validationCode":"// Skip first-user registration for external-strategy collections\nif (collectionConfig.auth.disableLocalStrategy) {\n  throw new Error('Cannot register a local first user on an external-strategy collection')\n}\nawait payload.registerFirstUser({ collection, data, req })","typeGuard":"function usesLocalStrategy(cfg: CollectionConfig): boolean {\n  return !cfg.auth?.disableLocalStrategy\n}","tryCatchPattern":"if (collectionConfig.auth.disableLocalStrategy) {\n  // bootstrap via IdP instead\n} else {\n  await payload.registerFirstUser({ collection, data, req })\n}","preventionTips":["Branch bootstrap logic on `auth.disableLocalStrategy`.","Reserve `registerFirstUser` for local-strategy collections only.","Document which collections are SSO-managed in setup docs."],"tags":["auth","register","ssso","config"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}