langflow-ai/langflow · warning · HTTPException

Auto login is disabled.

Error message

Auto login is disabled.

What it means

403 from GET /api/v1/auto_login when AUTO_LOGIN is disabled in auth settings. The endpoint only mints tokens when auth_settings.AUTO_LOGIN is true; otherwise it raises 403 with a structured detail {message, auto_login: false} so clients can detect the mode programmatically. It is included_in_schema=False — an internal/UI endpoint.

Source

Thrown at src/backend/base/langflow/api/v1/login.py:161

            response.set_cookie(
                "apikey_tkn_lflw",
                str(user.store_api_key),  # Ensure it's a string
                httponly=auth_settings.ACCESS_HTTPONLY,
                samesite=auth_settings.ACCESS_SAME_SITE,
                secure=auth_settings.ACCESS_SECURE,
                expires=None,  # Set to None to make it a session cookie
                domain=auth_settings.COOKIE_DOMAIN,
            )

            if get_settings_service().settings.agentic_experience:
                from langflow.api.utils.mcp.agentic_mcp import initialize_agentic_user_variables

                await initialize_agentic_user_variables(user.id, db)

        return tokens

    raise HTTPException(
        status_code=status.HTTP_403_FORBIDDEN,
        detail={
            "message": "Auto login is disabled.",
            "auto_login": False,
        },
    )


@router.post("/refresh", include_in_schema=False)
async def refresh_token(
    request: Request,
    response: Response,
    db: DbSession,
):
    auth_settings = get_settings_service().auth_settings

    token = request.cookies.get("refresh_token_lf")

View on GitHub (pinned to 976ec789d2)

Solutions

1. Switch the client to the real login flow (POST /login with credentials)
2. If anonymous single-user mode is intended, set AUTO_LOGIN=true in auth settings (e.g. LANGFLOW_AUTO_LOGIN=true) and restart
3. Use the structured detail.auto_login=false field to branch UI behavior instead of string matching

# probe before relying on auto-login
resp = await client.get("/api/v1/auto_login")
if resp.status_code == 403:
    await real_login(client)  # fall back to credential flow

interface AutoLoginDisabledDetail {
  detail: { message: string; auto_login: false };
}
function isAutoLoginDisabled(err: unknown): boolean {
  return (
    typeof err === "object" && err !== null &&
    "response" in err &&
    (err as any).response?.status === 403 &&
    (err as any).response?.data?.detail?.auto_login === false
  );
}

try:
    tokens = await client.get("/api/v1/auto_login")
except httpx.HTTPStatusError as e:
    if e.response.status_code == 403:
        tokens = await credential_login(client)
    else:
        raise

When it happens

Trigger: GET /auto_login on any deployment with AUTO_LOGIN=false (the default whenever authentication is enabled); UI probing auto-login availability on a secured instance.

Common situations: Frontend defaults to auto-login flow but the server runs with auth on; dev config (AUTO_LOGIN=true) not carried to prod, or vice versa; scripts assuming the anonymous dev mode.

Related errors

• A2A access is disabled for this agent: unsupported folder au
• An error occurred during authentication
• Incorrect username or password
• Invalid refresh token
• The {provider_label} integration is not configured for {oper

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/dcbe86eb1e549681. Report an issue: GitHub.