invoke-ai/InvokeAI · warning · HTTPException

Multiuser mode is disabled. Authentication is not required i

Error message

Multiuser mode is disabled. Authentication is not required in single-user mode.

What it means

The /auth/login endpoint refuses to authenticate when multiuser mode is off, because in single-user mode no auth is required at all. It raises 403 with this detail before any credential check.

Source

Thrown at invokeai/app/api/routers/auth.py:215

    response: Response,
) -> LoginResponse:
    """Authenticate user and return access token.

    Args:
        request: Login credentials (email and password)

    Returns:
        LoginResponse containing JWT token and user information

    Raises:
        HTTPException: 401 if credentials are invalid or user is inactive
        HTTPException: 403 if multiuser mode is disabled
    """
    config = ApiDependencies.invoker.services.configuration

    # Check if multiuser is enabled
    if not config.multiuser:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Multiuser mode is disabled. Authentication is not required in single-user mode.",
        )

    user_service = ApiDependencies.invoker.services.users
    user = user_service.authenticate(login_request.email, login_request.password)

    if user is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Bearer"},
        )

    if not user.is_active:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User account is disabled")

    # Create token with appropriate expiration

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Start InvokeAI with multiuser enabled (invokeai-web --multiuser) if you need login/tokens
2. Skip the login step — in single-user mode requests work without a Bearer token
3. Gate the client's auth flow on a server capability/config flag instead of always logging in
4. Update local dev scripts/CI to call endpoints without auth headers

Example fix

// before
const { access_token } = await api.post('/auth/login', creds); // 403 in single-user mode
// after
if (serverConfig.multiuser) { const { access_token } = await api.post('/auth/login', creds); }

cfg = requests.get(f'{base}/app/config').json()
if not cfg.get('multiuser', False):
    print('Single-user mode: skip login, no auth header needed')

def requires_login(server_config: dict) -> bool:
    return bool(server_config.get('multiuser', False))

try:
    resp = requests.post(f'{base}/auth/login', json=creds)
    resp.raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 403 and 'single-user' in e.response.json().get('detail', ''):
        proceed_without_auth()  # single-user mode: call APIs directly

When it happens

Trigger: POSTing to /auth/login (or calling set_token on the login flow) while the server was started without --multiuser / multiuser=false in config.

Common situations: Client app or UI still performing a login flow after the operator switched the install to single-user; scripts that log in unconditionally; CI hitting a local dev server without multiuser enabled.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Multiuser mode is disabled. Admin setup is not required in s
• User account is disabled
• str(e)
• Incorrect email or password
• Authentication required

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/f007e25e1ed72acc. Report an issue: GitHub.