{"record":{"id":"dcbe86eb1e549681","repo":"langflow-ai/langflow","slug":"auto-login-is-disabled","errorCode":null,"errorMessage":"Auto login is disabled.","messagePattern":"Auto login is disabled\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"src/backend/base/langflow/api/v1/login.py","lineNumber":161,"sourceCode":"\n            response.set_cookie(\n                \"apikey_tkn_lflw\",\n                str(user.store_api_key),  # Ensure it's a string\n                httponly=auth_settings.ACCESS_HTTPONLY,\n                samesite=auth_settings.ACCESS_SAME_SITE,\n                secure=auth_settings.ACCESS_SECURE,\n                expires=None,  # Set to None to make it a session cookie\n                domain=auth_settings.COOKIE_DOMAIN,\n            )\n\n            if get_settings_service().settings.agentic_experience:\n                from langflow.api.utils.mcp.agentic_mcp import initialize_agentic_user_variables\n\n                await initialize_agentic_user_variables(user.id, db)\n\n        return tokens\n\n    raise HTTPException(\n        status_code=status.HTTP_403_FORBIDDEN,\n        detail={\n            \"message\": \"Auto login is disabled.\",\n            \"auto_login\": False,\n        },\n    )\n\n\n@router.post(\"/refresh\", include_in_schema=False)\nasync def refresh_token(\n    request: Request,\n    response: Response,\n    db: DbSession,\n):\n    auth_settings = get_settings_service().auth_settings\n\n    token = request.cookies.get(\"refresh_token_lf\")\n","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/login.py#L143-L179","documentation":"403 from GET /api/v1/auto_login when AUTO_LOGIN is disabled in auth settings. The endpoint only mints tokens when auth_settings.AUTO_LOGIN is true; otherwise it raises 403 with a structured detail {message, auto_login: false} so clients can detect the mode programmatically. It is included_in_schema=False — an internal/UI endpoint.","triggerScenarios":"GET /auto_login on any deployment with AUTO_LOGIN=false (the default whenever authentication is enabled); UI probing auto-login availability on a secured instance.","commonSituations":"Frontend defaults to auto-login flow but the server runs with auth on; dev config (AUTO_LOGIN=true) not carried to prod, or vice versa; scripts assuming the anonymous dev mode.","solutions":["Switch the client to the real login flow (POST /login with credentials)","If anonymous single-user mode is intended, set AUTO_LOGIN=true in auth settings (e.g. LANGFLOW_AUTO_LOGIN=true) and restart","Use the structured detail.auto_login=false field to branch UI behavior instead of string matching"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# probe before relying on auto-login\nresp = await client.get(\"/api/v1/auto_login\")\nif resp.status_code == 403:\n    await real_login(client)  # fall back to credential flow","typeGuard":"interface AutoLoginDisabledDetail {\n  detail: { message: string; auto_login: false };\n}\nfunction isAutoLoginDisabled(err: unknown): boolean {\n  return (\n    typeof err === \"object\" && err !== null &&\n    \"response\" in err &&\n    (err as any).response?.status === 403 &&\n    (err as any).response?.data?.detail?.auto_login === false\n  );\n}","tryCatchPattern":"try:\n    tokens = await client.get(\"/api/v1/auto_login\")\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 403:\n        tokens = await credential_login(client)\n    else:\n        raise","preventionTips":["Branch on detail.auto_login === false rather than string-matching the message","Build clients for secured deployments with the credential flow from the start","Keep AUTO_LOGIN consistent across environments you deploy to"],"tags":["auth","auto-login","http-403","configuration","langflow"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}