bytedance/deer-flow · error · HTTPException

User not found

Error message

User not found

What it means

The JWT decoded successfully, but the `sub` claim points at a user that no longer exists in the local user provider (`get_user(payload.sub)` returned None). The token itself is structurally valid; the account behind it was deleted. HTTP 401 'User not found'.

Source

Thrown at backend/app/gateway/langgraph_auth.py:92

        return AUTH_DISABLED_USER_ID

    token = request.cookies.get("access_token")
    if not token:
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="Not authenticated",
        )

    payload = decode_token(token)
    if isinstance(payload, TokenError):
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="Invalid token",
        )

    user = await get_local_provider().get_user(payload.sub)
    if user is None:
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="User not found",
        )
    if user.token_version != payload.ver:
        raise Auth.exceptions.HTTPException(
            status_code=401,
            detail="Token revoked (password changed)",
        )

    return payload.sub


@auth.on
async def add_owner_filter(ctx: Auth.types.AuthContext, value: dict):
    """Inject user_id metadata on writes; filter by user_id on reads.

    Gateway stores thread ownership as ``metadata.user_id``.
    This handler ensures LangGraph Server enforces the same isolation.

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Clear the `access_token` cookie and log in again as an existing user
2. If the user should exist, verify the user store backing `get_local_provider()` actually contains that user id
3. After account deletion flows, proactively clear auth cookies server-side or bump token_version so stale cookies fail fast with a clearer path

try {
  await call();
} catch (e) {
  if (e.status === 401 && e.detail === 'User not found') {
    clearAuthCookie();
    redirect('/login'); // account is gone; re-auth as a real user
  } else throw e;
}

When it happens

Trigger: Logging in, then having the account deleted by an admin or a user-management script, then reusing the still-valid cookie; a rebuilt/reset user database where user IDs changed while cookies survived; importing/migrating users with new IDs.

Common situations: User database wiped during dev iterations while browsers keep cookies; account deletion flows that don't invalidate outstanding cookies; test environments with ephemeral user stores.

Related errors

• Authentication required
• NOT_AUTHENTICATED
• Token error: {payload.value}
• USER_NOT_FOUND
• TOKEN_INVALID

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/9e7a916e10f71f45. Report an issue: GitHub.