invoke-ai/InvokeAI · error · HTTPException

User account is disabled

Error message

User account is disabled

What it means

After credentials authenticate successfully, login checks user.is_active; a deactivated user gets 403 'User account is disabled'. This lets admins block accounts without deleting them.

Source

Thrown at invokeai/app/api/routers/auth.py:231

    # Check if multiuser is enabled
    if not config.multiuser:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Multiuser mode is disabled. Authentication is not required in single-user mode.",
        )

    user_service = ApiDependencies.invoker.services.users
    user = user_service.authenticate(login_request.email, login_request.password)

    if user is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Bearer"},
        )

    if not user.is_active:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User account is disabled")

    # Create token with appropriate expiration
    expires_delta = timedelta(
        days=TOKEN_EXPIRATION_REMEMBER_ME if login_request.remember_me else TOKEN_EXPIRATION_NORMAL
    )
    token_data = TokenData(
        user_id=user.user_id,
        email=user.email,
        is_admin=user.is_admin,
        remember_me=login_request.remember_me,
        token_epoch=user.token_epoch,
    )
    token = create_access_token(token_data, expires_delta)
    _set_media_cookie(request, response, token, int(expires_delta.total_seconds()))

    return LoginResponse(
        token=token,
        user=user,

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Have an admin re-enable the account (set is_active=True via the user management endpoint)
2. Log in with a different, active account
3. Recreate/reactivate the user if the account was disabled by mistake
4. If you're the admin, use the admin account to change the flag

# if you can query an admin endpoint, confirm the account is active first
user = admin_get_user(email)
if user and not user['is_active']:
    raise PermissionError(f'Account {email} is disabled; ask an admin to re-enable')

def is_active_user(user: dict | None) -> bool:
    return bool(user and user.get('is_active'))

try:
    resp = requests.post(f'{base}/auth/login', json=creds)
    resp.raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 403 and 'disabled' in e.response.json().get('detail', ''):
        contact_admin()  # do not retry — account-level block

When it happens

Trigger: POST /auth/login with correct credentials belonging to a user whose is_active flag is False in the users store.

Common situations: Admin disabled the account via the user-management API; account deactivated pending approval; stale import/seed data marking users inactive; automation accounts disabled by policy.

Related errors

• Multiuser mode is disabled. Authentication is not required i
• Multiuser mode is disabled. Admin setup is not required in s
• Incorrect email or password
• Authentication required
• User not found

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/69fc81841a4244bd. Report an issue: GitHub.