{"record":{"id":"f007e25e1ed72acc","repo":"invoke-ai/InvokeAI","slug":"multiuser-mode-is-disabled-authentication-is-not","errorCode":null,"errorMessage":"Multiuser mode is disabled. Authentication is not required in single-user mode.","messagePattern":"Multiuser mode is disabled\\. Authentication is not required in single-user mode\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/auth.py","lineNumber":215,"sourceCode":"    response: Response,\n) -> LoginResponse:\n    \"\"\"Authenticate user and return access token.\n\n    Args:\n        request: Login credentials (email and password)\n\n    Returns:\n        LoginResponse containing JWT token and user information\n\n    Raises:\n        HTTPException: 401 if credentials are invalid or user is inactive\n        HTTPException: 403 if multiuser mode is disabled\n    \"\"\"\n    config = ApiDependencies.invoker.services.configuration\n\n    # Check if multiuser is enabled\n    if not config.multiuser:\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Multiuser mode is disabled. Authentication is not required in single-user mode.\",\n        )\n\n    user_service = ApiDependencies.invoker.services.users\n    user = user_service.authenticate(login_request.email, login_request.password)\n\n    if user is None:\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=\"Incorrect email or password\",\n            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n\n    if not user.is_active:\n        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=\"User account is disabled\")\n\n    # Create token with appropriate expiration","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/auth.py#L197-L233","documentation":"The /auth/login endpoint refuses to authenticate when multiuser mode is off, because in single-user mode no auth is required at all. It raises 403 with this detail before any credential check.","triggerScenarios":"POSTing to /auth/login (or calling set_token on the login flow) while the server was started without --multiuser / multiuser=false in config.","commonSituations":"Client app or UI still performing a login flow after the operator switched the install to single-user; scripts that log in unconditionally; CI hitting a local dev server without multiuser enabled.","solutions":["Start InvokeAI with multiuser enabled (invokeai-web --multiuser) if you need login/tokens","Skip the login step — in single-user mode requests work without a Bearer token","Gate the client's auth flow on a server capability/config flag instead of always logging in","Update local dev scripts/CI to call endpoints without auth headers"],"exampleFix":"// before\nconst { access_token } = await api.post('/auth/login', creds); // 403 in single-user mode\n// after\nif (serverConfig.multiuser) { const { access_token } = await api.post('/auth/login', creds); }","handlingStrategy":"fallback","validationCode":"cfg = requests.get(f'{base}/app/config').json()\nif not cfg.get('multiuser', False):\n    print('Single-user mode: skip login, no auth header needed')","typeGuard":"def requires_login(server_config: dict) -> bool:\n    return bool(server_config.get('multiuser', False))","tryCatchPattern":"try:\n    resp = requests.post(f'{base}/auth/login', json=creds)\n    resp.raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403 and 'single-user' in e.response.json().get('detail', ''):\n        proceed_without_auth()  # single-user mode: call APIs directly","preventionTips":["Detect multiuser mode from server config before running auth flows","Keep single-user and multiuser onboarding paths separate in your client","Document the server launch flags (--multiuser) in deployment scripts","Don't hardcode a mandatory login step in automation"],"tags":["http-403","authentication","config"],"backgroundTag":"auth-not-required-single-user-mode","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}