bytedance/deer-flow · error · HTTPException

Automatic account creation is disabled. Contact your adminis

Error message

Automatic account creation is disabled. Contact your administrator.

What it means

HTTP 403 raised when no existing OAuth link, no blocking local account, but provider_config.auto_create_users is false. The provider is in 'invite-only' mode: unknown identities cannot self-register, so an administrator must create the account (or the link) first.

Source

Thrown at backend/app/gateway/auth/user_provisioning.py:80

            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="Your email domain is not allowed. Please use an approved email address.",
            )

    # 4. Block if a local account already owns this email. We never auto-link an
    # SSO identity onto a pre-existing local account, since that would let an SSO
    # login take over a password account that happens to share the email.
    local_user = await local_provider.get_user_by_email(email)

    if local_user:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail=("An account with this email already exists. Contact your administrator to link it to your SSO account."),
        )

    # 5. Auto-create
    if not provider_config.auto_create_users:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Automatic account creation is disabled. Contact your administrator.",
        )

    role = _resolve_role(email, provider_config.admin_emails)
    try:
        user = await local_provider.create_oauth_user(
            email=email,
            oauth_provider=provider_id,
            oauth_id=identity.subject,
            system_role=role,
        )
    except ValueError:
        # Lost a race: a concurrent callback (double-click, replayed code) already
        # inserted a row that collides on the unique index. Re-resolve instead of
        # bubbling a raw 500. If the winner created this same identity, return it;
        # otherwise the email now belongs to a different account → 409.
        existing = await local_provider.get_user_by_oauth(provider_id, identity.subject)

View on GitHub (pinned to 1dd6ba1acb)

Solutions

Have an administrator pre-create/link the user's account
Set auto_create_users: true for the provider in config.yaml and restart the Gateway

Example fix

# config.yaml (provider entry)
# before
auto_create_users: false
# after
auto_create_users: true

Defensive patterns

Strategy: validation

Validate before calling

linked = await local_provider.get_user_by_oauth(provider_id, identity.subject)
if not linked and not provider_config.auto_create_users:
    return RedirectResponse("/login?error=invite_only")

Try / catch

try:
    await provision_oauth_user(provider_id, identity, provider_config)
except HTTPException as e:
    if e.status_code == 403 and "Automatic account creation is disabled" in e.detail:
        return page("request-access")
    raise

Prevention

Decide invite-only vs open registration per provider before go-live
Give admins a bulk-provision script when auto_create_users is false
Include the flag in the provider's config checklist

When it happens

Trigger: First SSO login by a user unknown to the system when config.yaml sets auto_create_users: false for that provider. All prior checks (verified email, email present, domain allowed, no conflicting local account) passed.

Common situations: Locked-down enterprise deployments where accounts are pre-provisioned; piloting SSO with self-registration disabled; forgetting to flip the flag after the pilot.

Related errors

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/03d826dfc7c64c0a. Report an issue: GitHub.