bytedance/deer-flow · warning · HTTPException

registration_disabled

registration_disabled

Error message

Self-registration is disabled on this deployment

What it means

403 from POST /api/auth/register: the deployment sets auth.local.allow_registration to false, so self-service account creation is closed. Only the first admin (via /initialize) and admin-managed user creation remain. The body carries code 'registration_disabled'.

Source

Thrown at backend/app/gateway/routers/auth.py:353

    from deerflow.config.app_config import get_app_config

    try:
        return get_app_config().auth.local.allow_registration
    except FileNotFoundError:
        return True


@router.post("/register", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
async def register(request: Request, response: Response, body: RegisterRequest):
    """Register a new user account (always 'user' role).

    The first admin is created explicitly through /initialize. This endpoint creates regular users.
    Auto-login by setting the session cookie.

    Returns 403 when ``auth.local.allow_registration`` is false.
    """
    if not _local_registration_enabled():
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail=AuthErrorResponse(code=AuthErrorCode.REGISTRATION_DISABLED, message="Self-registration is disabled on this deployment").model_dump(),
        )

    try:
        user = await get_local_provider().create_user(email=body.email, password=body.password, system_role="user")
    except ValueError:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=AuthErrorResponse(code=AuthErrorCode.EMAIL_ALREADY_EXISTS, message="Email already registered").model_dump(),
        )

    token = create_access_token(str(user.id), token_version=user.token_version)
    _set_session_cookie(response, token, request, remember_me=body.remember_me)

    return UserResponse(id=str(user.id), email=user.email, system_role=user.system_role, oauth_provider=user.oauth_provider)

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Set auth.local.allow_registration: true in config.yaml (then restart/reload the Gateway) if self-registration should be allowed
2. Otherwise create accounts through an admin or use /initialize for the first admin
3. Hide the registration UI when the flag is off (the frontend can expose this via config endpoint if available)

Example fix

# config.yaml — before
auth:
  local:
    allow_registration: false

# after
auth:
  local:
    allow_registration: true

const cfg = await getPublicConfig();
if (!cfg.auth?.local?.allow_registration) hideSignup();

try { await register(...); } catch (e) { if (e.status === 403 && e.body?.code === 'registration_disabled') { showMessage('Signup closed on this server'); return; } throw e; }

When it happens

Trigger: POST /api/auth/register on any deployment where config.yaml's auth.local.allow_registration is false or omitted-but-defaulted-off; hitting the sign-up page of a closed instance.

Common situations: Single-tenant or internal deployments that disable open signup; the frontend still routing users to a register page after the flag was flipped; config reload after which the flag took effect.

Related errors

• Your email could not be verified by the identity provider. P
• The identity provider did not provide an email address.
• Your email domain is not allowed. Please use an approved ema
• Automatic account creation is disabled. Contact your adminis
• Permission denied: {resource}:{action}

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/7d45cb2bd01b3206. Report an issue: GitHub.