bytedance/deer-flow · error · HTTPException

Not authenticated

Error message

Not authenticated

What it means

Raised by the LangGraph-compatible auth dependency when the request carries no `access_token` cookie. The handler runs a CSRF check first, then short-circuits with HTTP 401 the moment the cookie is absent, before any JWT decode or DB lookup. It means the caller never presented credentials at all, not that they presented bad ones.

Source

Thrown at backend/app/gateway/langgraph_auth.py:78

@auth.authenticate
async def authenticate(request):
    """Validate the session cookie, decode JWT, and check token_version.

    Same validation chain as Gateway's get_current_user_from_request:
      cookie → decode JWT → DB lookup → token_version match
    Also enforces CSRF on state-changing methods.
    """
    # CSRF check before authentication so forged cross-site requests
    # are rejected early, even if the cookie carries a valid JWT.
    _check_csrf(request)

    if is_auth_disabled():
        return AUTH_DISABLED_USER_ID

    token = request.cookies.get("access_token")
    if not token:
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="Not authenticated",
        )

    payload = decode_token(token)
    if isinstance(payload, TokenError):
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="Invalid token",
        )

    user = await get_local_provider().get_user(payload.sub)
    if user is None:
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="User not found",
        )
    if user.token_version != payload.ver:

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Log in through the login endpoint to obtain the `access_token` cookie and reuse the cookie jar in subsequent requests
2. For cross-origin frontends, send requests with `credentials: 'include'` and ensure the server CORS config allows credentials
3. If this is an unauthenticated local/dev deployment, set the auth-disabled config so the dependency returns AUTH_DISABLED_USER_ID
4. If automating, drive the login flow once and persist cookies (e.g. requests.Session) instead of hand-crafting headers

Example fix

// before
const res = await fetch('https://host/api/langgraph/threads', {
  headers: { Authorization: 'Bearer ...' }, // cookie never sent
});
// after
const res = await fetch('https://host/api/langgraph/threads', {
  credentials: 'include', // sends access_token cookie
});

import requests

s = requests.Session()
resp = s.post(f"{base}/api/auth/login", json={"username": u, "password": p})
assert resp.ok, "login failed"
assert "access_token" in s.cookies, "no access_token cookie set — later calls will 401"

try {
  await api.getThreads();
} catch (e) {
  if (e.status === 401 && e.detail === 'Not authenticated') {
    await login(); // then retry once
  } else throw e;
}

When it happens

Trigger: Calling any `/api/langgraph/*` route (thread create, runs, streams) without first logging in via the auth flow that sets the `access_token` cookie; using a fetch/axios client configured with `credentials: 'omit'` or `same-origin` from a cross-origin origin; a browser session where the cookie expired and was dropped; hitting the API with a raw Bearer-token-style client when this stack only reads cookies.

Common situations: Scripts or integrations that assume Authorization headers work; cross-origin frontend misconfiguring credentials; cookie expiry (no refresh attempted); auth disabled flag not set in local dev so a previously-open endpoint now demands a cookie.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• NOT_AUTHENTICATED
• Authentication required
• Token error: {payload.value}
• USER_NOT_FOUND
• TOKEN_INVALID

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/1efa294b36d1cb01. Report an issue: GitHub.