bytedance/deer-flow · error · HTTPException

Your email domain is not allowed. Please use an approved ema

Error message

Your email domain is not allowed. Please use an approved email address.

What it means

HTTP 403 raised when provider_config.allowed_email_domains is a non-empty list and the lowercased domain of the identity's email is not in it. The allow-list comparison strips a leading '@' and lowercases entries, so 'Example.com' in config matches 'example.com' in the email.

Source

Thrown at backend/app/gateway/auth/user_provisioning.py:62

    if provider_config.require_verified_email and not identity.email_verified:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail=("Your email could not be verified by the identity provider. Please contact your administrator."),
        )

    if not identity.email:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="The identity provider did not provide an email address.",
        )

    email = identity.email.lower()

    # 3. Domain restriction
    if provider_config.allowed_email_domains:
        domain = email.rsplit("@", 1)[-1]
        if domain not in {d.lower().lstrip("@") for d in provider_config.allowed_email_domains}:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="Your email domain is not allowed. Please use an approved email address.",
            )

    # 4. Block if a local account already owns this email. We never auto-link an
    # SSO identity onto a pre-existing local account, since that would let an SSO
    # login take over a password account that happens to share the email.
    local_user = await local_provider.get_user_by_email(email)

    if local_user:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail=("An account with this email already exists. Contact your administrator to link it to your SSO account."),
        )

    # 5. Auto-create
    if not provider_config.auto_create_users:
        raise HTTPException(

View on GitHub (pinned to 1dd6ba1acb)

Solutions

Log in with an email under an approved domain
Add the missing domain to allowed_email_domains for the provider in config.yaml and restart the Gateway
Remove allowed_email_domains (or set it empty) if the restriction is not intended

Example fix

# config.yaml (provider entry)
# before
allowed_email_domains: [company.com]
# after
allowed_email_domains: [company.com, company-acquired.com]

Defensive patterns

Strategy: validation

Validate before calling

if provider_config.allowed_email_domains:
    domain = identity.email.rsplit("@", 1)[-1].lower()
    allowed = {d.lower().lstrip("@") for d in provider_config.allowed_email_domains}
    if domain not in allowed:
        return RedirectResponse("/login?error=domain_not_allowed")

Try / catch

try:
    await provision_oauth_user(provider_id, identity, provider_config)
except HTTPException as e:
    if e.status_code == 403 and "domain is not allowed" in e.detail:
        return redirect_to_login("domain_not_allowed")
    raise

Prevention

Keep allowed_email_domains lowercase and without '@' to match the normalization
Add every corporate domain (including acquisitions) before enabling SSO
Log the rejected domain (not PII-heavy) to spot config gaps quickly

When it happens

Trigger: First SSO login (no existing OAuth link) with allowed_email_domains set (e.g. [company.com]) while the user logs in with a personal address (gmail.com). Reached after the verified-email and email-present checks pass.

Common situations: Restricting a tenant to corporate domains; users choosing the wrong IdP account ('sign in with Google' personal vs workspace); typos or a leading '@' that is actually handled, but entries with uppercase-only mismatch already normalized; mergers adding new domains.

Related errors

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/d3174d6cea9c6ae2. Report an issue: GitHub.