langflow-ai/langflow · error · ValueError

Auth config is missing. Please check your settings and try a

Error message

Auth config is missing. Please check your settings and try again.

What it means

Raised by _get_mcp_composer_auth_config() in Langflow's MCP projects API when a project has no usable MCP Composer authentication settings. The helper reads project.auth_settings, runs decrypt_auth_settings() over it, and requires a truthy dict result; if auth_settings is null/empty or decrypts to an empty result, the ValueError 'Auth config is missing' is raised before any Composer URL can be built. Callers such as get_composer_sse_url() depend on this config to construct the http://<oauth_host>:<oauth_port>/sse endpoint.

Source

Thrown at src/backend/base/langflow/api/v1/mcp_projects.py:1344

    Args:
        project: The project object containing auth_settings

    Returns:
        dict: The decrypted authentication configuration

    Raises:
        HTTPException: If MCP Composer is not enabled or auth config is missing
    """
    auth_config = None
    if project.auth_settings:
        decrypted_settings = decrypt_auth_settings(project.auth_settings)
        if decrypted_settings:
            auth_config = decrypted_settings

    if not auth_config:
        error_message = "Auth config is missing. Please check your settings and try again."
        raise ValueError(error_message)

    return auth_config


# Project-specific MCP server instance for handling project-specific tools
class ProjectMCPServer:
    def __init__(self, project_id: UUID):
        self.project_id = project_id
        self.server = Server(f"langflow-mcp-project-{project_id}")
        # TODO: implement an environment variable to enable/disable stateless mode
        self.session_manager = StreamableHTTPSessionManager(self.server, stateless=True)
        # since we lazily initialize the session manager's lifecycle
        # via .run(), which can only be called once, otherwise an error is raised,
        # we use the lock to prevent race conditions on concurrent requests to prevent such an error
        self._manager_lock = anyio.Lock()
        self._manager_started = False  # whether or not the session manager is running

        # Register handlers that filter by project

View on GitHub (pinned to 976ec789d2)

Solutions

Configure MCP Composer auth settings for the project (oauth_host, oauth_port, and credentials) via the project settings endpoint/UI, then retry the Composer SSE URL request.
If settings were saved previously but decrypt to empty, verify the encryption key/secret used by decrypt_auth_settings matches the environment that originally encrypted project.auth_settings (check for changed LANGFLOW secret env vars after a redeploy).
Re-enter and re-save the Composer credentials so they are re-encrypted with the current key, overwriting stale auth_settings.
For tests, construct the project fixture with valid auth_settings (or mock _get_mcp_composer_auth_config) so the Composer path has credentials to read.

Example fix

# before: called on a project that may have no Composer config
sse_url = await get_composer_sse_url(project)  # ValueError: Auth config is missing

# after: validate first and surface a 4xx to the caller
settings = decrypt_auth_settings(project.auth_settings) if project.auth_settings else None
if not settings or not (settings.get("oauth_host") and settings.get("oauth_port")):
    raise HTTPException(status_code=400, detail="Configure MCP Composer auth settings for this project first")
sse_url = await get_composer_sse_url(project)

Defensive patterns

Strategy: validation

Validate before calling

from langflow.services.auth.utils import decrypt_auth_settings  # adjust import to actual module

def has_mcp_composer_auth(project) -> bool:
    """True when the project can serve a Composer SSE URL."""
    if not getattr(project, "auth_settings", None):
        return False
    settings = decrypt_auth_settings(project.auth_settings)
    return bool(settings) and bool(settings.get("oauth_host")) and bool(settings.get("oauth_port"))

Try / catch

try:
    sse_url = await get_composer_sse_url(project)
except ValueError as e:
    if "Auth config is missing" in str(e):
        raise HTTPException(
            status_code=400,
            detail="MCP Composer is not configured for this project. Set oauth host/port and credentials in project settings.",
        ) from e
    raise

Prevention

Require Composer auth settings to be saved before enabling MCP Composer features for a project (validate in the settings-save UI flow)
Keep the encryption secret stable across environments, or re-encrypt auth_settings after key rotation, so decrypt_auth_settings never returns empty
In tests, always populate auth_settings on project fixtures that exercise Composer endpoints

When it happens

Trigger: Calling get_composer_sse_url(project) (or any flow that invokes _get_mcp_composer_auth_config) for a Folder/project whose auth_settings column is NULL, an empty dict/string, or holds encrypted content that decrypt_auth_settings cannot decode into a non-empty dict (e.g. encrypted with a different key or corrupted ciphertext).

Common situations: MCP Composer was never configured for the project in the UI before requesting its SSE URL; the database was migrated or restored between environments so auth_settings ciphertext is undecryptable with the current secrets key; a race where the project record is read before the user finishes saving Composer credentials; tests using a bare Folder fixture with no auth_settings.

Related errors

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/ef074b272b3c9abd. Report an issue: GitHub.