invoke-ai/InvokeAI · error · HTTPException

str(e)

Error message

str(e)

What it means

HTTP 400 raised when `user_service.create_admin(...)` throws ValueError during setup_admin (auth.py:399). The service validates the admin fields and — when `config.strict_password_checking` is true — password strength; any ValueError (bad username, weak password, duplicate name) is forwarded verbatim as the exception detail via `str(e)`.

Source

Thrown at invokeai/app/api/routers/auth.py:399

    # Check if any admin exists
    if user_service.has_admin():
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Administrator account already configured",
        )

    # Create admin user - this will validate password strength
    try:
        user_data = UserCreateRequest(
            email=request.email,
            display_name=request.display_name,
            password=request.password,
            is_admin=True,
        )
        user = user_service.create_admin(user_data, strict_password_checking=config.strict_password_checking)
    except ValueError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e

    return SetupResponse(success=True, user=user)


# ---------------------------------------------------------------------------
# User management models
# ---------------------------------------------------------------------------

_PASSWORD_ALPHABET = string.ascii_letters + string.digits + string.punctuation


class AdminUserCreateRequest(BaseModel):
    """Request body for admin to create a new user."""

    email: str = Field(description="User email address")
    display_name: str | None = Field(default=None, description="Display name")
    password: str = Field(description="User password")
    is_admin: bool = Field(default=False, description="Whether user should have admin privileges")

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Read the `detail` string of the 400 response — it is the service ValueError and states the exact validation failure (e.g. weak password).
2. Use a password satisfying the configured strength rules (length/complexity) or relax strict_password_checking in invokeai.yaml for dev environments.
3. Choose a unique username; check existing users before calling setup.
4. Validate the SetupRequest payload client-side (non-empty username/display_name, password length) before POSTing.

Example fix

// before: fixed weak password in provisioning script
const body = {username:'admin', display_name:'Admin', password:'admin123'};
// after: strong generated password
const body = {username:'admin', display_name:'Admin', password: crypto.randomBytes(16).toString('base64url') + '!Aa1'};

function validateSetupPayload(p) {
  const errs = [];
  if (!p.username || !p.username.trim()) errs.push('username required');
  if (!p.display_name || !p.display_name.trim()) errs.push('display_name required');
  if (!p.password || p.password.length < 12) errs.push('password too weak (min 12 chars)');
  return errs; // empty array => safe to POST /auth/setup
}

function isSetupRequest(v) {
  return typeof v === 'object' && v !== null &&
    typeof v.username === 'string' && v.username.length > 0 &&
    typeof v.display_name === 'string' &&
    typeof v.password === 'string' && v.password.length >= 12;
}

try {
  await setupAdmin(body);
} catch (e) {
  if (e.status === 400) {
    console.error('Setup rejected by service:', e.detail); // exact ValueError
  } else throw e;
}

When it happens

Trigger: POST /auth/setup whose payload contains a weak password while strict_password_checking is enabled, an invalid/empty username or display_name, or a username that already exists in the users table.

Common situations: Automated provisioning scripts POSTing a weak default password (e.g. 'admin123') against a strict-password config; duplicate setup calls where the second request reuses an already-taken username; locale/whitespace issues in display_name.

Related errors

• Current password is required to set a new password
• No external provider config fields provided
• Administrator account already configured
• The system user cannot be deleted, deactivated, promoted to
• Cannot remove the last administrator

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/5e5979a2c9e17151. Report an issue: GitHub.